---
title: "TYPO3-EXT-SA-2012-005: Several vulnerabilities in third party extensions"
url: "https://news.typo3.com/security/advisory/typo3-ext-sa-2012-005"
description: "Several vulnerabilities have been found in the following third-party TYPO3 extensions: fe_whois, cag_tables, additional_reports, general_data_display, realty, dkd_feuser_belogin, tc_fbconnect, dix_easylogin, ajado_facebook, facebook2t3, sociallogin2t3, kb_eventboard, news"
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - TYPO3 Extensions
---

# TYPO3-EXT-SA-2012-005: Several vulnerabilities in third party extensions

- Security / [TYPO3 Extensions](https://news.typo3.com/article/category/security/typo3-extensions)

TYPO3-EXT-SA-2012-005: Several vulnerabilities in third party extensions
========================================================================

28 March 2012

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

Several vulnerabilities have been found in the following third-party TYPO3 extensions: fe\_whois, cag\_tables, additional\_reports, general\_data\_display, realty, dkd\_feuser\_belogin, tc\_fbconnect, dix\_easylogin, ajado\_facebook, facebook2t3, sociallogin2t3, kb\_eventboard, news

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

**Release Date:** March 28, 2012

**Please read first:** This Collective Security Bulletin (CSB) is a listing of vulnerable extensions with neither significant download numbers, nor other special importance amongst the TYPO3 Community. The intention of CSBs is to reduce the workload of the TYPO3 Security Team and of the maintainers of extensions with vulnerabilities. Nevertheless, vulnerabilities in TYPO3 core or important extensions will still get the well-known single Security Bulletin each.

Please read our [buzz blog post](http://buzz.typo3.org/teams/security/article/collective-security-bulletins-csb-the-reason-for/), which has a detailed explanation on CSBs.

All vulnerabilities affect third-party extensions. These extensions are not part of the TYPO3 default installation.

**Extension:** WhoisLookup (fe\_whois)

**Affected Versions:** 0.0.2 and all versions below

**Vulnerability Type:** Arbitrary Code Execution

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The extension author claimed he will not maintain the extension any more. Please uninstall and delete the extension folder from your installation.

**Credits:** Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.

**Extension:** Display CSV / Excel files or database tables (cag\_tables)

**Affected Version:** 3.0.2 and all versions below

**Vulnerability Type:** SQL Injection, File Disclosure, Cross-Site Scripting

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 3.0.3) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/cag\_tables/3.0.3/](http://typo3.org/extensions/repository/view/cag_tables/3.0.3/ "Opens external link in new window").

**Note:** At the time of writing, the most recent version of Display CSV / Excel files or database tables is version 3.1.0 which is available at [http://typo3.org/extensions/repository/view/cag\_tables/3.1.0/](http://typo3.org/extensions/repository/view/cag_tables/3.1.0/ "Opens external link in new window").

**Credits:** Credits go to Frederic Gaus who discovered and reported this issue.

**Extension:** Useful informations in reports module (additional\_reports)

**Affected Versions:** 2.4.3 and all versions below

**Vulnerability Type:** File Disclosure

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 2.4.4) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/additional\_reports/2.4.4/](http://typo3.org/extensions/repository/view/additional_reports/2.4.4/ "Opens external link in new window").

**Note:** At the time of writing, the most recent version of Useful informations in reports module is version 2.4.6 which is available at [http://typo3.org/extensions/repository/view/additional\_reports/2.4.6/](http://typo3.org/extensions/repository/view/additional_reports/2.4.6/ "Opens external link in new window").

**Credits:** Credits go to Security Team Member Georg Ringer who discovered and reported this issue.

**Extension:** General data display (general\_data\_display)

**Affected Versions:** 1.4.2 and all versions below

**Vulnerability Type:** Cross-Site Scripting, SQL Injection

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 1.4.3) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/general\_data\_display/1.4.3/](http://typo3.org/extensions/repository/view/general_data_display/1.4.3/ "Opens external link in new window").

**Credits:** Credits go to Security Team Member Helmut Hummel who discovered and reported the SQL Injection vulnerability.

**Extension:** Realty Manager (realty)

**Affected Versions:** 0.5.2 and all versions below

**Vulnerability Type:** Unserialize vulnerability

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 0.5.3) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/realty/0.5.3/](http://typo3.org/extensions/repository/view/realty/0.5.3/ "Opens external link in new window").

**Credits:** Credits go to the extension author Oliver Klee who discovered and reported the issue.

**Extension:** FEUser->BELogin (dkd\_feuser\_belogin)

**Affected Versions:** 1.2.8 and all versions below

**Vulnerability Type:** SQL Injection

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 1.2.9) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/dkd\_feuser\_belogin/1.2.9/](http://typo3.org/extensions/repository/view/dkd_feuser_belogin/1.2.9/ "Opens external link in new window").

**Credits:** Credits go to Markus Hausammann who discovered and reported the issue.

**Extension:** TCFacebook Connect (tc\_fbconnect)

**Affected Versions:** 0.0.1

**Vulnerability Type:** Authentication bypass

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 0.0.2) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/tc\_fbconnect/0.0.2/](http://typo3.org/extensions/repository/view/tc_fbconnect/0.0.2/ "Opens external link in new window").

**Note:** The extension provides an update script (available as extension function through extension manager) which will randomize user passwords of accounts with a facebook ID assigned.

**Credits:** Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.

**Extension:** Easy Login and Register with OpenID (FE) (dix\_easylogin)

**Affected Versions:** 0.2.5 and all version below

**Vulnerability Type:** Authentication bypass

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 0.2.6) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/dix\_easylogin/0.2.6/](http://typo3.org/extensions/repository/view/dix_easylogin/0.2.6/ "Opens external link in new window").

**Note:** At the time of writing, the most recent version of Easy Login and Register with OpenID (FE) is version 0.2.7 which is available at [http://typo3.org/extensions/repository/view/dix\_easylogin/0.2.7/](http://typo3.org/extensions/repository/view/dix_easylogin/0.2.7/ "Opens external link in new window").

**Credits:** Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.

**Extension:** Ajado Facebook Connect (ajado\_facebook)

**Affected Versions:** 0.2.1 and all version below

**Vulnerability Type:** Authentication bypass

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 0.2.2) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/ajado\_facebook/0.2.2/](http://typo3.org/extensions/repository/view/ajado_facebook/0.2.2/ "Opens external link in new window").

**Note:** At the time of writing, the most recent version of Ajado Facebook Connect is version 0.3.2 which is available at [http://typo3.org/extensions/repository/view/ajado\_facebook/0.3.2/](http://typo3.org/extensions/repository/view/ajado_facebook/0.3.2/ "Opens external link in new window").

**Credits:** Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.

**Extension:** Facebook Connect to TYPO3 (facebook2t3)

**Affected Versions:** 0.2.2 and all version below

**Vulnerability Type:** Authentication bypass

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 0.2.3) is available from the TYPO3 extension manager and a t[http://typo3.org/extensions/repository/view/facebook2t3/0.2.3/](http://typo3.org/extensions/repository/view/facebook2t3/0.2.3/ "Opens external link in new window").

**Credits:** Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.

**Extension:** Social Login to TYPO3 (sociallogin2t3)

**Affected Versions:** 0.2.0 and all version below

**Vulnerability Type:** Authentication bypass

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:C/I:P/A:N/E:U/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 0.2.1) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/sociallogin2t3/0.2.1/](http://typo3.org/extensions/repository/view/sociallogin2t3/0.2.1/ "Opens external link in new window").

**Credits:** Credits go to Security Team Member Franz G. Jahn who discovered and reported this issue.

**Extension:** Event Board (kb\_eventboard)

**Affected Versions:** 1.0.31 and all version below

**Vulnerability Type:** SQL Injection

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 1.0.32) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/kb\_eventboard/1.0.32/](http://typo3.org/extensions/repository/view/kb_eventboard/1.0.32/ "Opens external link in new window").

**Credits:** Credits go to Danny Affeldt who discovered and reported this issue.

**Extension:** News system (news)

**Affected Versions:** 1.3.1 and all version below

**Vulnerability Type:** SQL Injection

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:C/I:N/A:N/E:POC/RL:OF/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An update (version 1.3.2) is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/news/1.3.2/](http://typo3.org/extensions/repository/view/news/1.3.2/ "Opens external link in new window").

**Credits:** Credits go to Sascha Egerer and extension maintainer Georg Ringer who discovered and reported this issue.

**General advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://typo3.org/documentation/document-library/extension-manuals/doc_guide_security/current/ "Initiates file download"). Please subscribe to the [typo3-announce mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce "Opens external link in new window") to receive future Security Bulletins via E-mail.

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

[More posts by this author](https://news.typo3.com/article/author/marcus-krause)