CVE-2013-5957

🗓️ 27 Nov 2013 18:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 40 Views🌐 WEB

SQL injection in CiviCRM allows remote attackers to execute arbitrary SQL commands via _value parameter

Reporter	Title	Published	Views	Family All 8
Cvelist	CVE-2013-5957	27 Nov 201318:00	–	cvelist
Debian CVE	CVE-2013-5957	27 Nov 201318:00	–	debiancve
EUVD	EUVD-2013-5789	7 Oct 202500:30	–	euvd
NVD	CVE-2013-5957	27 Nov 201318:55	–	nvd
OpenVAS	WordPress Plugin CiviCRM '_value' Parameter SQL Injection Vulnerability	3 Dec 201300:00	–	openvas
OpenVAS	Drupal Module CiviCRM '_value' Parameter SQL Injection Vulnerability - Active Check	4 Dec 201300:00	–	openvas
OpenVAS	Joomla Plugin CiviCRM '_value' Parameter SQLi Vulnerability	5 Dec 201300:00	–	openvas
Prion	Sql injection	27 Nov 201318:55	–	prion

NVD

Node

civicrm civicrmMatch4.4alpha3

civicrm civicrmMatch4.4.0alpha1

civicrm civicrmMatch4.4.0alpha2

Node

civicrm civicrmRange≤4.2.11

Node

Source	Link
navixia	www.navixia.com/company/navixia-news/395-navixia-finds-critical-vulnerability-in-civicrm.html
civicrm	www.civicrm.org/advisory/civi-sa-2013-009-sql-injection-vulnerability
github	www.github.com/civicrm/civicrm-core/pull/1708.diff
navixia	www.navixia.com/blog/entry/navixia-finds-critical-vulnerability-in-civicrm-cve-2013-5957.html

Parameter	Position	Path	Description	CWE
_value	request body	ajax/jqState	SQL injection via _value parameter to ajax/jqState endpoint in CiviCRM (CVE-2013-5957)	CWE-89
_value	request body	ajax/jqcounty	SQL injection via _value parameter to ajax/jqcounty endpoint in CiviCRM (CVE-2013-5957)	CWE-89

29 Apr 2026 01:13Current

8.7High risk

Vulners AI Score8.7

CVSS 27.5

EPSS0.00362