TYPO3 News Plugin "NewsController.php" Blind SQL Injection Vulnerability


Description   (:A blind SQL injection vulnerability was reported in the News plugin for TYPO3.:An authenticated remote attacker could exploit it by sending specially crafted HTTP POST requests in order to access data stored into the database like username and associated password (stored in "be_users" table).::This vulnerability, located in several parameters of "NewsController.php" script page, stems from an improper user-input validation and an improper blacklist for input passed to "OrderByAllowed" parameter.::A proof of concept is available.)
     
Vulnerable Products   Vulnerable Software:
Typo3 (Typo3) -
     
Solution   Set overrideDemand parameter to "0".
     
CVE  
     
References   - Ambionics : TYPO3 News module SQL Injection
https://www.ambionics.io/blog/typo3-news-module-sqli
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
SQL injection Prevention - POST : suspicious UPDATE statement in data
5.0.0
SQL injection Prevention - POST : suspicious SELECT statement in data
5.0.0
SQL injection Prevention - POST : suspicious DECLARE statement in data
5.0.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data
5.0.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data
5.0.0
SQL injection Prevention - POST : suspicious CAST statement in data
5.0.0
SQL injection Prevention - POST : suspicious EXEC statement in data
5.0.0
SQL injection Prevention - POST : suspicious CREATE statement in data
5.0.0
SQL injection Prevention - POST : suspicious INSERT statement in data
5.0.0
SQL injection Prevention - POST : suspicious DROP statement in data
5.0.0
SQL injection Prevention - POST : suspicious HAVING statement in data
5.0.0
SQL injection Prevention - POST : suspicious UNION statement in data
5.0.0
SQL injection Prevention - POST : suspicious OR statement in data
5.0.0
SQL injection Prevention - POST : possible version probing in data
5.0.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2017-04-06 

 Target Type 
Server 

 Possible exploit 
Remote