CVE-2013-5957: SQL Injection
Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the value parameter to (1) ajax/jqState or (2) ajax/jqcounty.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5957?
CVE-2013-5957 is classified as a high severity vulnerability due to its potential for remote exploitation via SQL injection.
How do I fix CVE-2013-5957?
To fix CVE-2013-5957, upgrade CiviCRM to version 4.2.12 or later, 4.3.7 or later, or 4.4.beta4 or later.
Which versions of CiviCRM are affected by CVE-2013-5957?
CVE-2013-5957 affects CiviCRM versions prior to 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4.
What types of attacks can exploit CVE-2013-5957?
CVE-2013-5957 can be exploited for SQL injection attacks, allowing remote attackers to execute arbitrary SQL commands.
Is CVE-2013-5957 a common vulnerability in CiviCRM?
Yes, CVE-2013-5957 is one of the known SQL injection vulnerabilities that have been identified in earlier versions of CiviCRM.