civicrm/civicrm-core · Security
CiviCRM SQL injection vulnerability via Quick Search API
- GHSA ID
- GHSA-4465-r2hg-v4rj
- CVE ID
- CVE-2013-4662
- Severity
- medium
- Published
- Updated
Description
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
CWEs
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')