CVE-2013-4662 - The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick

Back Back to CVE browser

MEDIUM

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick

Published Jan 29, 2014

6.5

MEDIUM

CVSS 2.0

EPSS 1.01%

Description

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

http://issues.civicrm.org/jira/browse/CRM-12765
x_refsource_CONFIRMVendor Advisory
https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api
x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-4465-r2hg-v4rj
Advisory
https://issues.civicrm.org/jira/browse/CRM-12765
https://nvd.nist.gov/vuln/detail/CVE-2013-4662

Link	Providers	Tags
http://issues.civicrm.org/jira/browse/CRM-12765		x_refsource_CONFIRMVendor Advisory
https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api		x_refsource_CONFIRMVendor Advisory
https://github.com/advisories/GHSA-4465-r2hg-v4rj		Advisory
https://issues.civicrm.org/jira/browse/CRM-12765
https://nvd.nist.gov/vuln/detail/CVE-2013-4662