GHSA-9895-53fc-98v2: TYPO3 SQL Injection in dbal

June 3, 2024

A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sql_query are vulnerable, even if arguments were properly escaped with DatabaseConnection::quoteStr beforehand.

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2016-02-16-1.yaml
github.com/advisories/GHSA-9895-53fc-98v2
typo3.org/article/typo3-core-sa-2016-001

Code Behaviors & Features

Detect and mitigate GHSA-9895-53fc-98v2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →