CVE-2013-4662: SQL Injection
Published Jan 29, 2014
·Updated
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
Affected Software
15 affected componentsFixes available
composer/civicrm/civicrm-core>=4.3.0<4.3.3
4.3.3
composer/civicrm/civicrm-core>=4.2.0<4.2.9
4.2.9
CiviCRM CiviCRM=4.2.0
CiviCRM CiviCRM=4.2.1
CiviCRM CiviCRM=4.2.2
CiviCRM CiviCRM=4.2.4
CiviCRM CiviCRM=4.2.5
CiviCRM CiviCRM=4.2.6
CiviCRM CiviCRM=4.2.7
CiviCRM CiviCRM=4.2.8
CiviCRM CiviCRM=4.2.9
CiviCRM CiviCRM=4.3.0
CiviCRM CiviCRM=4.3.1
CiviCRM CiviCRM=4.3.2
CiviCRM CiviCRM=4.3.3
Event History
Jan 29, 2014
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
May 17, 2022
Advisory Published
04:52 AM
Frequently Asked Questions
1
What is the severity of CVE-2013-4662?
CVE-2013-4662 is considered a high severity vulnerability due to its potential for SQL injection attacks.
2
How do I fix CVE-2013-4662?
To fix CVE-2013-4662, update your CiviCRM installation to version 4.3.4 or later.
3
Which versions are affected by CVE-2013-4662?
CVE-2013-4662 affects CiviCRM versions 4.2.0 to 4.2.9 and 4.3.0 to 4.3.3.
4
What type of vulnerability is CVE-2013-4662?
CVE-2013-4662 is classified as an SQL injection vulnerability allowing for unauthorized data manipulation.
5
Can unprivileged users exploit CVE-2013-4662?
Yes, remote authenticated users can exploit CVE-2013-4662 to bypass validation and perform SQL injection.