CVE-2017-16558: SQL Injection
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
Other sources
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module.
— GitHub
SQL injection vulnerabililty in the back end search filter
SQL injection vulnerabililty in the front end listing module
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16558?
CVE-2017-16558 is considered to have a high severity due to its SQL injection vulnerability.
How do I fix CVE-2017-16558?
To fix CVE-2017-16558, upgrade your Contao installation to version 4.4.8 or later.
What versions are affected by CVE-2017-16558?
CVE-2017-16558 affects Contao versions from 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7.
Is CVE-2017-16558 a remote vulnerability?
Yes, CVE-2017-16558 can be exploited remotely through specially crafted SQL queries.
What components of Contao are impacted by CVE-2017-16558?
CVE-2017-16558 impacts the Contao backend and the listing module.