Description
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| isotope | isotope-core | ≤ 2.9.10 | — |
References
- GitHub Issue #2585 issue-tracking
- https://github.com/isotope/core product
- Callback::onLoad() interpolates $dc->id into the WHERE clause at 2.9.10 technical-description
- Callback::validateForeignKey() interpolates the table and column name at 2.9.10 technical-description
- ProductPrice\Callback interpolates $dc->id into SELECT and DELETE statements at 2.9.10 technical-description
- MediaManager::getFallbackData() interpolates the table, column and record id at 2.9.10 technical-description
- VulnCheck Advisory: Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks third-party-advisory