Description

The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.

Remediation

References

CVE-2010-5104

Related Vulnerabilities

Oracle JRE CVE-2013-2432 Vulnerability (CVE-2013-2432)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0787)

MySQL CVE-2023-22070 Vulnerability (CVE-2023-22070)

PHP Other Vulnerability (CVE-2007-1286)

WordPress 4.3.x Multiple Vulnerabilities (4.3 - 4.3.23)

Severity

Medium

Classification

CVE-2010-5104 CWE-200

Tags

Missing Update Known Vulnerabilities