{"id":"CVE-2012-6144","aliases":["DSA-2574-1","EUVD-2022-3284","GHSA-947m-vgqc-x6v4"],"status":"published","title":"Typo3 Backend History Module Vulnerable to SQL Injection","description":"SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02169,"percentile":0.8239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2012-11-15T00:00:00Z","modified":"2026-06-16T23:47:54Z","fixes":[{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["4.5.21","4.6.14","4.7.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"last_affected":"4.5.20"},{"fixed":"4.5.21"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"last_affected":"4.6.13"},{"fixed":"4.6.14"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"last_affected":"4.7.5"},{"fixed":"4.7.6"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"typo3-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9+dfsg1-1+squeeze7"}]}],"versions":["4.3.9+dfsg1-1","4.3.9+dfsg1-1+squeeze1","4.3.9+dfsg1-1+squeeze2","4.3.9+dfsg1-1+squeeze3","4.3.9+dfsg1-1+squeeze4","4.3.9+dfsg1-1+squeeze5","4.3.9+dfsg1-1+squeeze6"],"bundled":4},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0"},{"fixed":"4.5.21"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.6.14"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"4.7.6"}]}]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79964","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/06/19/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://osvdb.org/87115","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6144","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-947m-vgqc-x6v4"},{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-6144","description":"SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.","status":"published","published":"2013-07-01T21:00:00Z","modified":"2024-08-06T21:28:39.439Z","updated_at":"2026-11-02T14:34:51.269982Z"}],"euvd":[{"id":"EUVD-2022-3284","description":"SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.","status":"published","published":"2013-07-01T21:00:00Z","modified":"2024-08-06T21:28:39Z","updated_at":"2026-11-03T01:56:02.409289Z"}],"ghsa":[{"id":"GHSA-947m-vgqc-x6v4","title":"Typo3 Backend History Module Vulnerable to SQL Injection","description":"SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6  Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.","status":"published","published":"2022-05-17T01:37:41Z","modified":"2024-01-12T18:00:16Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:30.812736Z"}],"nvd":[{"id":"CVE-2012-6144","description":"SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to execute arbitrary SQL commands via unspecified vectors.","status":"published","published":"2013-07-01T21:55:01.63Z","modified":"2026-06-16T23:47:54.26Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"DSA-2574-1","title":"typo3-src - several","status":"published","published":"2012-11-15T00:00:00Z","modified":"2026-03-09T01:23:15.579474Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-947m-vgqc-x6v4","title":"Typo3 Backend History Module Vulnerable to SQL Injection","description":"SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6  Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.","status":"published","published":"2022-05-17T01:37:41Z","modified":"2024-01-12T18:26:37.298847Z","cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}