CVE-2013-4662: CiviCRM SQL injection vulnerability via Quick Search API
CiviCRM SQL injection vulnerability via Quick Search API
Other sources
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/civicrm/civicrm-coreto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
composer/civicrm/civicrm-coreto a version that resolves this vulnerability.Fixed in 4.2.9
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4662?
CVE-2013-4662 is considered a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2013-4662?
To fix CVE-2013-4662, update your CiviCRM installation to version 4.3.4 or later.
Which versions are affected by CVE-2013-4662?
CVE-2013-4662 affects CiviCRM versions 4.2.0 to 4.2.9 and 4.3.0 to 4.3.3.
What type of vulnerability is CVE-2013-4662?
CVE-2013-4662 is classified as an SQL injection vulnerability allowing for unauthorized data manipulation.
Can unprivileged users exploit CVE-2013-4662?
Yes, remote authenticated users can exploit CVE-2013-4662 to bypass validation and perform SQL injection.