CVE-2008-6463: SQL Injection
SQL injection vulnerability in the Diocese of Portsmouth Church Search (pdchurchsearch) extension before 0.1.1, and 0.2.10 and earlier 0.2.x versions, an extension for TYPO3, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Diocese of Portsmouth Church Search (pd_churchsearch) extension for TYPO3to a version that resolves this vulnerability.Fixed in 0.1.1 - Compensating control
Until a fixed release is available or an upgrade is applied, isolate or restrict network access to hosts running pd_churchsearch versions reported as 'before 0.1.1' or '0.2.10 and earlier 0.2.x versions' (for example, apply firewall rules or network ACLs to limit external access to the application management interfaces).
- Operational
Scan TYPO3 installations for the 'pd_churchsearch' extension. Identify any installations with versions reported as 'before 0.1.1' or '0.2.10' / 'earlier 0.2.x versions' and flag them as vulnerable for remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6463?
CVE-2008-6463 has been categorized with a medium severity due to its potential for SQL injection attacks.
How do I fix CVE-2008-6463?
To fix CVE-2008-6463, upgrade the pd_churchsearch extension to version 0.1.1 or 0.2.11 or later.
What type of attacks does CVE-2008-6463 allow?
CVE-2008-6463 allows remote attackers to execute arbitrary SQL commands on the server.
Which versions of the ChurchSearch extension are affected by CVE-2008-6463?
Versions of the ChurchSearch extension before 0.1.1 and 0.2.10 and earlier are affected by CVE-2008-6463.
Is TYPO3 itself affected by CVE-2008-6463?
No, TYPO3 itself is not affected by CVE-2008-6463, only the specific versions of the pd_churchsearch extension.