TYPO3 Multiple Third-Party Components Vulnerabilities


Description   Several vulnerabilities were reported in plugins for TYPO3:
- sb_akronymmanager: SQL injection via the "id" parameter of the "ext/sb_akronymmanager/mod1/index.php" page (CVE-2015-2803)
- BE User Log: cross-site scripting
- Frontend User Upload: arbitrary code execution
- wt_directory: SQL injection
- Smoelenboek: SQL injection
- Store Locator: SQL injection
- Developer Log: SQL injection. In order to exploit this vulnerability, the attacker must have permissions to access to the module
- Frequently Asked Questions: SQL injection
- Job Fair: arbitrary code execution.
A proof of concept is available for the CVE-2015-2803 vulnerability.
     
Vulnerable Products   Vulnerable Software:
Typo3 (Typo3)
     
Solution   New versions of the following plugins fix these vulnerabilities:- sb_akronymmanager: 7.0.0 - wt_directory: 1.4.2- Smoelenboek: 1.0.9- Store Locator: 3.3.1- Developer Log: 2.11.4- Frequently Asked Questions: 1.2.1- Job Fair: 1.0.1.The following plugins are end-of-life. It is recommended to uninstall them:- BE User Log- Frontend User Upload.
     
CVE   CVE-2015-2803
     
References   - TYPO3-EXT-SA-2015-014: SQL Injection in EXT:sb_akronymmanager
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-014/
TYPO3-EXT-SA-2015-007: Cross-Site Scripting in extension BE User Log (beko_beuserlog)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-007/
TYPO3-EXT-SA-2015-006: Arbitrary Code Execution in extension Frontend User Upload (feupload)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-006/
TYPO3-EXT-SA-2015-008: SQL Injection vulnerability in extension wt_directory (wt_directory)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-008/
TYPO3-EXT-SA-2015-010: SQL Injection vulnerability in extension Smoelenboek (ncgov_smoelenboek)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-010/
TYPO3-EXT-SA-2015-009: SQL Injection vulnerability in extension Store Locator (locator)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-009/
TYPO3-EXT-SA-2015-011: SQL Injection vulnerability in extension Developer Log (devlog)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-011/
TYPO3-EXT-SA-2015-012: SQL Injection vulnerability in extension FAQ
Frequently Asked Questions (js_faq)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-012/
TYPO3-EXT-SA-2015-013: Arbitrary Code Execution in extension Job Fair (jobfair)
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-013/
RT-SA-2015-002 : SQL Injection in TYPO3 Extension Akronymmanager
https://www.redteam-pentesting.de/en/advisories/rt-sa-2015-002/-sql-injection-in-typo3-extension-akronymmanager
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
SQL injection Prevention - GET : suspicious OR statement in URL
3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL
3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL
3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL
3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL
3.2.0
SQL injection Prevention - GET : possible database version probing
3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL
3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL
3.2.0
SQL injection Prevention - GET : block comment delimiters in URL
3.2.0
SQL injection Prevention - GET : suspicious SQL statement in header
4.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement
5.0.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2015-06-15 

 Target Type 
Server 

 Possible exploit 
Remote