CVE-2013-4720

Vulnerability

The WEC Discussion Forum extension (wec_discussion) for TYPO3 contains a SQL injection vulnerability in versions 2.1.1 and all versions below. The vulnerability exists through unspecified vectors in the extension's handling of input, allowing an attacker to inject malicious SQL statements.

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication or any special privileges. By sending crafted input to the vulnerable parameters, the attacker can manipulate SQL queries executed by the extension.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the underlying database. This can lead to unauthorized reading and modification of data, disclosure of sensitive information, and potentially privilege escalation within the TYPO3 instance.

Mitigation

The vulnerability is fixed in version 2.1.2 of the WEC Discussion Forum extension, which is available from the TYPO3 extension manager and at the extension repository [1]. Users should update to this version immediately. No workaround is provided for versions prior to 2.1.2.