Read the docs
TI-2022-26477 Aliases GHSA-v3mr-gp7j-pw5w

Possible SQL injection in tablelookupwizard Contao Extension

Priority LOW 38CWE-89Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
SQL injection
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-89.

Summary

### Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. ### Patches The issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0. ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/terminal42/contao-tablelookupwizard * Email us at [[email protected]](mailto:[email protected])

Why it matters now

Fix Fixed terminal42/contao-tablelookupwizard (Packagist): 3.3.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—terminal42/contao-tablelookupwizard (Packagist)before 3.3.53.3.5Patch availableGHSA-v3mr-gp7j-pw5w
  • terminal42/contao-tablelookupwizard (Packagist) Vendor— Affected before 3.3.5 Fixed in 3.3.5 Patch available GHSA-v3mr-gp7j-pw5w

Remediation

  • Fix · GHSA-v3mr-gp7j-pw5w terminal42/contao-tablelookupwizard (Packagist) Fixed in 3.3.5 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-v3mr-gp7j-pw5w

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences