Insert tag injection in the login module

Date : 2019-12-17 CVE ID : CVE-2019-19714 Description It is possible to inject insert tags into the login module which will be replaced when the page is rendered. Affected versions Contao 4.8.4 and 4.8.5 Suggested solution Update to Contao 4.8.6...

Information disclosure in the back end

Date : 2019-12-17 CVE ID : CVE-2019-19712 Description Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.45 Contao 4.5 Contao 4.6 Contao 4.7 Contao 4....

PT-2019-15923

Name of the Vulnerable Software and Affected Versions Contao versions 4.0 through 4.8.5 Description The issue allows back end users to manipulate the details view URL, enabling them to show pages and articles that have not been enabled for them. Recommendations For Contao versions 4.0 through...

CVE-2019-19712: Incorrect Default Permissions

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them...

Unrestricted file uploads

Date : 2019-12-17 CVE ID : CVE-2019-19745 Description A back end user with access to the form generator can upload arbitrary files and execute them on the server. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.45 Contao 4.5 Contao 4.6 Contao 4.7 Contao 4.8 up t...

PT-2019-15943

Name of the Vulnerable Software and Affected Versions Contao versions 4.0 through 4.8.5 Description The issue allows a back end user with access to the form generator to upload arbitrary files and execute them on the server, enabling PHP local file inclusion. This can be exploited by a user with...

CVE-2019-19714: Improper Encoding or Escaping of Output

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered...

PT-2019-15924

Name of the Vulnerable Software and Affected Versions Contao versions 4.8.4 through 4.8.5 Description The issue concerns improper encoding or escaping of output, allowing the injection of insert tags into the login module. These tags are replaced when the page is rendered. Recommendations For...

CVE-2019-19745: Unrestricted Upload of File with Dangerous Type

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...

SQL Injection

contao/core-bundle is vulnerable to SQL injection. The vulnerability exists in the value of strField in the file manager search filter, which allows a remote attacker to inject and execute arbitrary SQL queries through the affected parameter...

CVE-2019-11512

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

CVE-2019-11512

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

Sql injection

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

CVE-2019-11512

CVE-2019-11512 describes an SQL injection in Contao 4.x, exploitable via the file manager. Affected versions span Contao 4.1 through 4.7.4, with exposure up to 4.4.38. The issue is fixed in Contao 4.4.39 and 4.7.5 (as confirmed by multiple sources). Red Hat notes the same fixed versions; other ad...

CVE-2019-11512

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

CVE-2019-11512

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

PT-2019-12345

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.4.39 Contao versions prior to 4.7.5 Description The issue allows SQL Injection. A penetration tester discovered that the SQL injection vulnerability can still be exploited in the file manager in Contao 4...

CVE-2019-11512: Improper Neutralization of Special Elements used in an SQL Command

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...

Contao SQL Injection Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . Contao has a SQL injection vulnerability that can be exploited by attackers to execute illegal SQL commands...

SQL injection in the file manager

Date : 2019-04-30 CVE ID : CVE-2019-11512 Description David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4. The security vulnerability has the identifier...