---
title: "TYPO3-EXT-SA-2013-017: Several vulnerabilities in third party extensions"
url: "https://news.typo3.com/security/advisory/typo3-ext-sa-2013-017"
description: "Several vulnerabilities have been found in the following third-party TYPO3 extensions: booking, cronmm_ratsinfo, ics_awstats, iflowgallery, ke_userregister, meta_beawstatsind, powermail_optin, smarty, youtubevideos"
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - TYPO3 Extensions
---

# TYPO3-EXT-SA-2013-017: Several vulnerabilities in third party extensions

- Security / [TYPO3 Extensions](https://news.typo3.com/article/category/security/typo3-extensions)

TYPO3-EXT-SA-2013-017: Several vulnerabilities in third party extensions
========================================================================

25 September 2013

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

Several vulnerabilities have been found in the following third-party TYPO3 extensions: booking, cronmm\_ratsinfo, ics\_awstats, iflowgallery, ke\_userregister, meta\_beawstatsind, powermail\_optin, smarty, youtubevideos

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

**Release Date:**  September 25, 2013

**Please read first:** This Collective Security Bulletin (CSB) is a listing of vulnerable extensions with neither significant download numbers, nor other special importance amongst the TYPO3 Community. The intention of CSBs is to reduce the workload of the TYPO3 Security Team and of the maintainers of extensions with vulnerabilities. Nevertheless, vulnerabilities in TYPO3 core or important extensions will still get the well-known single Security Bulletin each.

Please read our [buzz blog post](http://buzz.typo3.org/teams/security/article/collective-security-bulletins-csb-the-reason-for/), which has a detailed explanation on CSBs.

All vulnerabilities affect third-party extensions. These extensions are not part of the TYPO3 default installation.

**Extension:** booking (booking)

**Affected Versions:** 0.2.7 and all versions below

**Vulnerability Type:** Insecure Unserialize

**Severity:** High

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:O/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An updated version 0.2.9 is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/booking/0.2.9/](http://typo3.org/extensions/repository/view/booking/0.2.9/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible.

**Extension:** ics\_awstats

**Affected Versions:** 0.5.4 and all versions below

**Vulnerability Type:** Unspecific

**Severity:** High

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:O/RC:C%29&g=2&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Related CVE**: [CVE-2012-4547](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4547)

**Problem Description:** The extension contains an old version of awstats which is vulnerable an unspecific type of attack.

**Solution:** An updated version 0.6.0 is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/ics\_awstats/0.6.0/](http://typo3.org/extensions/repository/view/ics_awstats/0.6.0/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible.

**Credits:** Credits go to Bjoern Pedersen,  Xaver Maierhofer and Andrea Herzog who informed us about the isse.

**Extension:** Simple Image Gallery (iflowgallery)

**Affected Versions:** 0.1.0 and all versions below

**Vulnerability Type:** SQL Injection

**Severity:** Critical

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:C/A:N/E:F/RL:U/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:C/A:N/E:F/RL:U/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. We were not able to contact the extension maintainer. Please uninstall and delete the extension folder from your installation.

**Credits:** Credits go to TYPO3 Security Team Member Franz G. Jahn who discovered and reported the issue.

**Extension:** Ratsinformationssystem (RIS) (cronmm\_ratsinfo)

**Affected Versions:** 1.2.0 and all versions below

**Vulnerability Type:** SQL Injection

**Severity:** High

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An updated version 1.3.0 is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/cronmm\_ratsinfo/1.3.0/](http://typo3.org/extensions/repository/view/cronmm_ratsinfo/1.3.0/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible.

**Credits:** Credits go to Peter Leußner who discovered and reported the issue.

**Extension:** Frontend User Registration (ke\_userregister)

**Affected Versions:** 0.1.5 and all versions below

**Vulnerability Type:** SQL Injection

**Severity:** High

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:P/A:N/E:F/RL:O/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** An updated version 0.1.6 is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/ke\_userregister/0.1.6/](http://typo3.org/extensions/repository/view/ke_userregister/0.1.6/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible.

**Credits:** Credits go to Extension Author Andreas Kiefer who discovered and reported the issue.

**Extension:** meta\_beawstatsind

**Affected Versions:** 1.0.1

**Vulnerability Type:** Unspecific

**Severity:** High

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:U/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:U/RC:C%29&g=2&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Related CVE**: [CVE-2012-4547](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4547)

**Problem Description:** The extension contains an old version of awstats which is vulnerable an unspecific type of attack.

**Solution:** Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The extension author claimed he will not maintain the extension any more. Please uninstall and delete the extension folder from your installation.

**Credits:** Credits go to Bjoern Pedersen,  Xaver Maierhofer and Andrea Herzog who informed us about the isse.

**Extension:** Powermail double opt-in (powermail\_optin)

**Affected Versions:** 1.0.1 and all versions below

**Vulnerability Type:** Authentication Bypass and Information Disclosure

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:P/I:P/A:N/E:P/RL:U/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:P/I:P/A:N/E:P/RL:U/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The extension author claimed he will not maintain the extension any more. Please uninstall and delete the extension folder from your installation.

**Extension**: smarty (smarty)

**Affected Versions:** 1.11.0 and all versions below

**Vulnerability Type:** Cross-Site Scripting

**Severity:** Low

**Suggested CVSS v2.0:**  [AV:N/AC:H/Au:N/C:P/I:P/A:N/E:P/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:P/I:P/A:N/E:P/RL:O/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Problem Description:** The extension smarty bundles the template engine smarty. Old versions of this library are known to be vulnerable to Cross-Site Scripting.

**Solution:** An updated version 1.13.1 is available from the TYPO3 extension manager and at [http://typo3.org/extensions/repository/view/smarty/1.13.1/](http://typo3.org/extensions/repository/view/smarty/1.13.1/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible.

**Credits:** Credits go to Alexander Wende who discovered and reported the issue.

**Extension:** Youtube Channel Videos (youtubevideos)

**Affected Versions:** 0.1.1 and all versions below

**Vulnerability Type:** Cross-Site Scripting

**Severity:** Medium

**Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:P/I:P/A:N/E:P/RL:U/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:P/I:P/A:N/E:P/RL:U/RC:C%29&g=2&lang=en "Opens external link in new window") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage"))

**Solution:** Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. The extension author failed in providing a security fix for the reported vulnerability in a decent amount of time. Please uninstall and delete the extension folder from your installation.

**Credits:** Credits go to Markus Klein who discovered and reported the issue.

**General advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Initiates file download"). Please subscribe to the [typo3-announce mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce "Opens external link in new window") to receive future Security Bulletins via E-mail.

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Marcus Krause](https://news.typo3.com/article/author/marcus-krause)

[More posts by this author](https://news.typo3.com/article/author/marcus-krause)