SNS Vulnerability

TYPO3 Extensions SQL Injection and Cross Site Scripting Vulnerabilities

Description

Multiple vulnerabilities have been identified in various TYPO3 extensions, which could be exploited by attackers to bypass security restrictions, disclose sensitive information or manipulate certain data. These issues are caused by access and input validation errors when processing user-supplied data, which could be exploited by malicious people to conduct SQL injection and cross site scripting attacks, or disclose certain information.

Vulnerable Products

Vulnerable Software:
MK-AnydropdownMenu (mk_anydropdownmenu) version 0.3.28 and priorPhoto Book (goof_fotoboek) version 1.7.14 and priorCustomer Reference List (ref_list) version 1.0.1 and priorSB Folderdownload (sb_folderdownload) version 0.2.2 and priorDeveloper log (devlog) version 2.9.1 and priorKJ: Imagelightbox (kj_imagelightbox2) version 2.0.0 and priorUnit Converter (cs2_unitconv) version 1.0.4powermail (powermail) version 1.5.1 and priorGooglemaps for tt_news (jf_easymaps) version 1.0.2 and priorTV21 Talkshow (tv21_talkshow) version 1.0.1 and priorHelpdesk (mg_help) version 1.1.6 and priorVote rank for news (vote_for_tt_news) version 1.0.1 and priorkiddog_mysqldumper (kiddog_mysqldumper) version 0.0.3 and priortt_news Mail alert (dl3_tt_news_alerts) version 0.2.0 and priorTT_Products editor (ttpedit) version 0.2.0 and priorUser Links (vm19_userlinks) version 0.1.1 and priorMJS Event Pro (mjseventpro) version 0.2.1 and priorBB Simple Jobs (bb_simplejobs) version 0.1.0 and priorReports for Job (job_reports) version 0.1.0 and priorClan Users List (pb_clanlist) version 0.0.1 and priorzak_store_management (zak_store_management) version 1.0.0 and priorMajordomo (majordomo) version 1.1.3 and priorTip many friends (mimi_tipfriends) version 0.0.2 and priorVD / Geomap (vd_geomap) version 0.3.1 and prior

Solution

Upgrade to fixed versions or disable the affected extensions : http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/

CVE

CVE-2010-0347
CVE-2010-0346
CVE-2010-0345
CVE-2010-0344
CVE-2010-0343
CVE-2010-0342
CVE-2010-0341
CVE-2010-0340
CVE-2010-0339
CVE-2010-0338
CVE-2010-0337
CVE-2010-0336
CVE-2010-0335
CVE-2010-0334
CVE-2010-0333
CVE-2010-0332
CVE-2010-0331
CVE-2010-0330
CVE-2010-0329
CVE-2010-0328
CVE-2010-0327
CVE-2010-0326
CVE-2010-0325
CVE-2010-0324
CVE-2010-0323
CVE-2010-0322

References

http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-021/

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious tag with event found in data	3.2.0
SQL injection Prevention - GET : suspicious OR statement in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
SQL injection Prevention - POST : suspicious SELECT statement in data	3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL	3.2.0
SQL injection Prevention - POST : possible version probing in data	3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL	3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL	3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL	3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL	3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	3.2.0
SQL injection Prevention - POST : suspicious OPENQUERY statement in data	3.2.0
SQL injection Prevention - POST : suspicious CREATE statement in data	3.2.0
XSS - Prevention - POST : 'location' javascript object found in data	3.2.0
SQL injection Prevention - POST : suspicious UPDATE statement in data	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - POST : javascript code found in data	3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	3.2.0
SQL injection Prevention - POST : suspicious UNION statement in data	3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL	3.2.0
XSS - Prevention - POST : code allowing cookie access found in data	3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL	3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL	3.2.0
SQL injection Prevention - POST : suspicious DROP statement in data	3.2.0
SQL injection Prevention - GET : possible database version probing	3.2.0
SQL injection Prevention - POST : suspicious INSERT statement in data	3.2.0
SQL injection Prevention - POST : suspicious OR statement in data	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
SQL injection Prevention - POST : suspicious EXEC statement in data	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL	3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	3.2.0
Misc : Remote code execution prevention: 2 '\|' characters found as a parameter of a script file	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL	3.2.0
SQL injection Prevention - POST : suspicious OPENROWSET statement in data	3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL	3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
SQL injection Prevention - GET : block comment delimiters in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
SQL injection Prevention - POST : suspicious DECLARE statement in data	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - POST : 'script' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
SQL injection Prevention - POST : suspicious HAVING statement in data	3.2.0
SQL injection Prevention - POST : suspicious CAST statement in data	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0

Risk level

Moderate

Vulnerability First Public Report Date

2010-01-14

Target Type

Client + Server

Possible exploit

Local & Remote