CVE-2013-4634 SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified ve...

HighCVSS 7.5 EPSS 1.4%

Published: 2013-06-21 02:00
Updated: 2026-06-17 02:57
Exploit status: No public exploit known

Description

SQL injection vulnerability in the jQuery autocomplete for indexed_search (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected products

Product	Affected versions	Fixed in
raphael zschorsch rzautocomplete	= 0.0.2	No fix listed
raphael zschorsch rzautocomplete	= 0.0.3	No fix listed
raphael zschorsch rzautocomplete	= 0.0.4	No fix listed
raphael zschorsch rzautocomplete	= 0.0.5	No fix listed
raphael zschorsch rzautocomplete	= 0.0.6	No fix listed
raphael zschorsch rzautocomplete	= 0.0.7	No fix listed
raphael zschorsch rzautocomplete	= 0.0.8	No fix listed

References

93815 vdb-entry
53633 third-party-advisory vendor-advisory
typo3.org
typo3.org vendor-advisory
60276 vdb-entry
typo3-jquery-unspecified-sql-injection(84659) vdb-entry

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.35% (percentile 72.0)
CWE: CWE-89

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.