GHSA-v3mr-gp7j-pw5w
Possible SQL injection in tablelookupwizard Contao Extension
Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.
Patches
The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/terminal42/contao-tablelookupwizard
- Email us at info@terminal42.ch
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
Possible SQL injection in tablelookupwizard Contao Extension
Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.
Patches
The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/terminal42/contao-tablelookupwizard
- Email us at info@terminal42.ch
- Record
GHSA-v3mr-gp7j-pw5w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Possible SQL injection in tablelookupwizard Contao Extension
Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.
Patches
The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0.
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/terminal42/contao-tablelookupwizard
- Email us at info@terminal42.ch
- Record
GHSA-v3mr-gp7j-pw5w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
terminal42/contao-tablelookupwizardPackagist | before 3.3.5 | 3.3.5 |
terminal42/contao-tablelookupwizardPackagist | before 3.3.5, plus listed versions 2.0.13.0.03.1.03.1.13.1.2 Show 8 moreShow less3.1.33.2.03.2.13.3.03.3.13.3.23.3.33.3.4 | 3.3.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-v3mr-gp7j-pw5w is a critical vulnerability (CVSS 9.8) in terminal42/contao-tablelookupwizard, published February 10, 2022. No source lists public exploit code. Fixed in terminal42/contao-tablelookupwizard 3.3.5.
References
github.com/terminal42/contao-tablelookupwizard/security/advisories/GHSA-v3mr-gp7j-pw5w