Skip to content
OpenAdvisories
Critical · 9.8 CVE-2017-16558 EUVD-2022-5472GHSA-w38g-hj45-mjjp

Contao SQL injection in the backend and listing module

Published Apr 25, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Package: contao/contao Package: contao/core-bundle Package: contao/listing-bundle Ecosystem: Packagist

Description

Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist contao/contao >= 3.0.0, <= 3.5.30 — GHSA-w38g-hj45-mjjp
Packagist contao/contao >= 4.0.0, < 4.4.8 4.4.8 GHSA-w38g-hj45-mjjp
Packagist contao/core-bundle >= 4.0.0, < 4.4.8 4.4.8 GHSA-w38g-hj45-mjjp
Packagist contao/core-bundle >= 3.0.0, <= 3.5.30 — GHSA-w38g-hj45-mjjp
Packagist contao/listing-bundle >= 4.0.0, < 4.4.8 4.4.8 GHSA-w38g-hj45-mjjp
Packagist contao/listing-bundle >= 3.0.0, <= 3.5.30 — GHSA-w38g-hj45-mjjp

References