high7.5Public exploit code
CVE-2009-4855
SQL injection vulnerability in index.php in TYPO3 4.0 allows remote attackers to execute arbitrary SQL commands via the showUid parameter.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- TYPO3 CMS 4.0 - 'showUid' SQL Injection2009-08-06 · webapps · php · Verified
Impact
SQL injection vulnerability in index.php in TYPO3 4.0 allows remote attackers to execute arbitrary SQL commands via the showUid parameter. NOTE: the TYPO3 Security Team disputes this report, stating that "there is no such vulnerability... The showUid parameter is generally used in third-party TYPO3 extensions - not in TYPO3 Core.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Typo3 | Typo3 | Version 4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secure.t3sec.info/blog/post/2009/08/06/typo3-cms-40-showuid-exploit-not-a-vulnerability/
- http://www.exploit-db.com/exploits/9380
- http://www.securityfocus.com/bid/35975
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52308
- http://secure.t3sec.info/blog/post/2009/08/06/typo3-cms-40-showuid-exploit-not-a-vulnerability/
- http://www.exploit-db.com/exploits/9380
- http://www.securityfocus.com/bid/35975
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52308