VYPR
← All advisories
Moderate severityNVD Advisory· Published May 21, 2012· Updated Apr 29, 2026

CVE-2010-5104

CVE-2010-5104

Description

The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information via wildcard characters in a LIKE query.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
typo3/cms-corePackagist
>= 4.2.0, < 4.2.164.2.16
typo3/cms-corePackagist
>= 4.3.0, < 4.3.94.3.9
typo3/cms-corePackagist
>= 4.4.0, < 4.4.54.4.5

Affected products

29
  • TYPO3/Typo329 versions
    cpe:2.3:a:typo3:typo3:4.2.0:*:*:*:*:*:*:*+ 28 more
    • cpe:2.3:a:typo3:typo3:4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.10:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.11:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.12:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.13:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.14:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.15:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.7:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.2.9:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:typo3:typo3:4.4.4:*:*:*:*:*:*:*

Patches

3
9eb4be4ccf10

Fixed bug #15737: quoteStrForLike does not properly escape strings in sql_mode NO_BACKSLASH_ESCAPES

https://github.com/TYPO3/typo3Oliver HaderDec 16, 2010via ghsa
commit
2 files changed · +28 −0
  • ChangeLog+1 −0 modified
    @@ -2,6 +2,7 @@
 
 	* Fixed bug #14402: XSS in Install tool (thanks to Benjamin Mack)
 	* Fixed bug #16590: t3lib_TSparser::checkIncludeLines() does not check files to be included (thanks to Fabrizio Branca)
+	* Fixed bug #15737: quoteStrForLike does not properly escape strings in sql_mode NO_BACKSLASH_ESCAPES
 
 2010-12-07  Christian Kuhn  <lolli@schwarzbu.ch>
  • t3lib/class.t3lib_db.php+27 −0 modified
    @@ -1124,11 +1124,38 @@ function sql_pconnect($TYPO3_db_host, $TYPO3_db_username, $TYPO3_db_password)	{
 					);
 				}
 			}
+			$this->setSqlMode();
 		}
 
 		return $this->link;
 	}
 
+	/**
+	 * Fixes the SQL mode by unsetting NO_BACKSLASH_ESCAPES if found.
+	 *
+	 * @return void
+	 */
+	protected function setSqlMode() {
+		$resource = $this->sql_query('SELECT @@SESSION.sql_mode;');
+		if (is_resource($resource)) {
+			$result = $this->sql_fetch_row($resource);
+			if (isset($result[0]) && $result[0] && strpos($result[0], 'NO_BACKSLASH_ESCAPES') !== FALSE) {
+				$modes = array_diff(
+					t3lib_div::trimExplode(',', $result[0]),
+					array('NO_BACKSLASH_ESCAPES')
+				);
+				$query = 'SET sql_mode=\'' . mysql_real_escape_string(implode(',', $modes)) . '\';';
+				$success = $this->sql_query($query);
+
+				t3lib_div::sysLog(
+					'NO_BACKSLASH_ESCAPES could not be removed from SQL mode: ' . $this->sql_error(),
+					'Core',
+					3
+				);
+			}
+		}
+	}
+
 	/**
 	 * Select a MySQL database
 	 * mysql_select_db() wrapper function
e8c32474a557

Fixed bug #15737: quoteStrForLike does not properly escape strings in sql_mode NO_BACKSLASH_ESCAPES

https://github.com/TYPO3/typo3Oliver HaderDec 16, 2010via ghsa
commit
2 files changed · +28 −0
  • ChangeLog+1 −0 modified
    @@ -2,6 +2,7 @@
 
 	* Fixed bug #14402: XSS in Install tool (thanks to Benjamin Mack)
 	* Fixed bug #16590: t3lib_TSparser::checkIncludeLines() does not check files to be included (thanks to Fabrizio Branca)
+	* Fixed bug #15737: quoteStrForLike does not properly escape strings in sql_mode NO_BACKSLASH_ESCAPES
 
 2010-12-01  Oliver Hader  <oliver@typo3.org>
  • t3lib/class.t3lib_db.php+27 −0 modified
    @@ -1039,11 +1039,38 @@ function sql_pconnect($TYPO3_db_host, $TYPO3_db_username, $TYPO3_db_password)	{
 					);
 				}
 			}
+			$this->setSqlMode();
 		}
 
 		return $this->link;
 	}
 
+	/**
+	 * Fixes the SQL mode by unsetting NO_BACKSLASH_ESCAPES if found.
+	 *
+	 * @return void
+	 */
+	protected function setSqlMode() {
+		$resource = $this->sql_query('SELECT @@SESSION.sql_mode;');
+		if (is_resource($resource)) {
+			$result = $this->sql_fetch_row($resource);
+			if (isset($result[0]) && $result[0] && strpos($result[0], 'NO_BACKSLASH_ESCAPES') !== FALSE) {
+				$modes = array_diff(
+					t3lib_div::trimExplode(',', $result[0]),
+					array('NO_BACKSLASH_ESCAPES')
+				);
+				$query = 'SET sql_mode=\'' . mysql_real_escape_string(implode(',', $modes)) . '\';';
+				$success = $this->sql_query($query);
+
+				t3lib_div::sysLog(
+					'NO_BACKSLASH_ESCAPES could not be removed from SQL mode: ' . $this->sql_error(),
+					'Core',
+					3
+				);
+			}
+		}
+	}
+
 	/**
 	 * Select a MySQL database
 	 * mysql_select_db() wrapper function
fcabd2fc2aa5

Fixed bug #15737: quoteStrForLike does not properly escape strings in sql_mode NO_BACKSLASH_ESCAPES

https://github.com/TYPO3/typo3Oliver HaderDec 16, 2010via ghsa
commit
2 files changed · +28 −0
  • ChangeLog+1 −0 modified
    @@ -2,6 +2,7 @@
 
 	* Fixed bug #14402: XSS in Install tool (thanks to Benjamin Mack)
 	* Fixed bug #16590: t3lib_TSparser::checkIncludeLines() does not check files to be included (thanks to Fabrizio Branca)
+	* Fixed bug #15737: quoteStrForLike does not properly escape strings in sql_mode NO_BACKSLASH_ESCAPES
 
 2010-11-12  Ernesto Baschny  <ernst@cron-it.de>
  • t3lib/class.t3lib_db.php+27 −0 modified
    @@ -937,11 +937,38 @@ function sql_pconnect($TYPO3_db_host, $TYPO3_db_username, $TYPO3_db_password)	{
 					t3lib_div::sysLog('Could not initialize DB connection with query "'.$v.'": '.mysql_error($this->link),'Core',3);
 				}
 			}
+			$this->setSqlMode();
 		}
 
 		return $this->link;
 	}
 
+	/**
+	 * Fixes the SQL mode by unsetting NO_BACKSLASH_ESCAPES if found.
+	 *
+	 * @return void
+	 */
+	protected function setSqlMode() {
+		$resource = $this->sql_query('SELECT @@SESSION.sql_mode;');
+		if (is_resource($resource)) {
+			$result = $this->sql_fetch_row($resource);
+			if (isset($result[0]) && $result[0] && strpos($result[0], 'NO_BACKSLASH_ESCAPES') !== FALSE) {
+				$modes = array_diff(
+					t3lib_div::trimExplode(',', $result[0]),
+					array('NO_BACKSLASH_ESCAPES')
+				);
+				$query = 'SET sql_mode=\'' . mysql_real_escape_string(implode(',', $modes)) . '\';';
+				$success = $this->sql_query($query);
+
+				t3lib_div::sysLog(
+					'NO_BACKSLASH_ESCAPES could not be removed from SQL mode: ' . $this->sql_error(),
+					'Core',
+					3
+				);
+			}
+		}
+	}
+
 	/**
 	 * Select a MySQL database
 	 * mysql_select_db() wrapper function

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

18

News mentions

0

No linked articles in our index yet.