CiviCRM SQL injection vulnerability via Quick Search API
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Aug 29, 2023
Package
Affected versions
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.3
Patched versions
4.2.9
4.3.3
Description
Published by the National Vulnerability Database
Jan 29, 2014
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Aug 29, 2023
Last updated
Aug 29, 2023
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
References