--- title: "TYPO3-CORE-SA-2013-001: SQL Injection and Open Redirection in TYPO3 Core" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2013-001" description: It has been discovered that TYPO3 Core is susceptible to SQL Injection and Open Redirection image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Product Updates & Roadmap" - TYPO3 CMS --- # TYPO3-CORE-SA-2013-001: SQL Injection and Open Redirection in TYPO3 Core - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2013-001: SQL Injection and Open Redirection in TYPO3 Core ======================================================================== 06 March 2013 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 Core is susceptible to SQL Injection and Open Redirection - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7569d41262328e5ed8d27b53e03970ec.png)[Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) **Component Type:** TYPO3 Core **Affected Versions:** 4.5.0 up to 4.5.23, 4.6.0 up to 4.6.16, 4.7.0 up to 4.7.8 and 6.0.0 up to 6.0.2 **Vulnerability Types:** SQL Injection, Open Redirection **Overall Severity:** High **Release Date:** March 6, 2013 Vulnerable subcomponent: Extbase Framework ------------------------------------------ **Vulnerability Type:** SQL Injection **Severity:** Critical **Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:C/I:C/A:N/E:H/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:C/I:C/A:N/E:H/RL:O/RC:C%29&g=3&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **Problem Description:** Failing to sanitize user input, the Extbase database abstraction layer is susceptible to SQL Injection. TYPO3 sites which have no Extbase extensions installed are not affected. Extbase extensions are affected if they use the Query Object Model and relation values are user generated input. (e.g. : $query->contains('model.categories', $userProvidedValue) ) **Solution:** Update to the TYPO3 version 4.5.24, 4.6.17, 4.7.9 or 6.0.3 that fix the problem described! **Credits:** Credits go to Helmut Hummel and Markus Opahle who discovered and reported the issue. **Note:** It has been reported to the TYPO3 Security Team that this problem is known and exploited in the wild. Vulnerable subcomponent: Access tracking mechanism -------------------------------------------------- **Vulnerability Type:** Open Redirection **Severity:** Medium **Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:N/I:P/A:N/E:H/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:N/I:P/A:N/E:H/RL:O/RC:C%29&g=3&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **Problem Description:** Failing to validate user provided input, the access tracking mechanism allows redirects to arbitrary URLs. **Solution:** Update to the TYPO3 version 4.5.24, 4.6.17, 4.7.9 or 6.0.3 that fix the problem described! **Important Notes:** To fix this vulnerability, we had to break existing behaviour of TYPO3 sites that use the access tracking mechanism (jumpurl feature) to transform **links to external sites**. The link generation has been changed to include a hash that is checked before redirecting to an external URL. This means that old links that have been distributed (e.g. by a newsletter) **will not work any more**. If you are using the jumpurl feature you need to do the following: - Clear the TYPO3 caches to prevent old links without required validation hash will be delivered If it is important that already distributed links  (e.g. by directmail newsletter module) are still working, you have to additionally: - Install the provided extension ([t3x](http://typo3.org/fileadmin/security-team/sa2013-01/jumpurl_redirect.t3x), [zip](http://typo3.org/fileadmin/security-team/sa2013-01/jumpurl_redirect.zip)) which covers the following cases: - URLs which are present in pages or content elements are allowed to be redirected to, even if the validation hash is missing or wrong. - URLs which are present in newletters sent using the third party module "directmail" are allowed to be redirected to, even if the validation hash is missing or wrong. If the above usecases do not cover your needs, you need to: - Adapt the provided extension or create your own extension with a redirect handler that fits your needs. If you have further questions regarding this issue, feel free to ask on a [public mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo) or in [our forum](http://forum.typo3.org/index.php/f/10/) to get the needed support. **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://typo3.org/documentation/document-library/extension-manuals/doc_guide_security/current/ "Opens external link in new window"). Please subscribe to the typo3-announce mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bb9efc51bced8582e7b8c235f4b5f2b5.png) About the Author [Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) [More posts by this author](https://news.typo3.com/article/author/helmut-hummel)