CVE-2009-3634

Vulnerability

The Frontend Login Box (felogin) subcomponent in TYPO3 versions 4.2.0 through 4.2.6 contains a cross-site scripting (XSS) vulnerability. Unspecified parameters are not properly sanitized before being reflected back to the user, enabling injection of arbitrary web script or HTML [1].

Exploitation

An attacker can exploit this flaw by crafting a malicious URL containing injected script in the vulnerable parameter. No authentication is required; the attacker only needs to trick a victim into visiting the crafted link. The script executes in the victim's browser within the context of the TYPO3 site.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive data. The attack operates at the privilege level of the victim user.

Mitigation

The vulnerability is fixed in TYPO3 versions 4.2.7 and later, as documented in TYPO3 Security Bulletin SA-2009-016 [1]. Users unable to upgrade should apply the patch provided in that bulletin. No other workarounds are disclosed in the available references.