Professional Content Management

Free and open source, TYPO3 CMS is the most widely used enterprise-level CMS.

Test TYPO3 now:

TYPO3 live demo

Inspire people to share

Offer your skills and contribute to the project. The community is growing and does more than just coding. 

A Community Effort

TYPO3 CMS is an Open Source project managed by the TYPO3 Association.

The Project

Do you have a question?

Ask the community or a professional partner.

TYPO3-SA-2009-012: Blind SQL Injection vulnerability in extension T3M E-Mail Marketing Tool (t3m)

It has been discovered that the extension T3M E-Mail Marketing Tool (t3m) is vulnerable to Blind SQL Injection attacks.

Release Date: August 18, 2009

Component Type: Third party extension. This extension is not part of the TYPO3 default installation.

Affected Versions: Version 0.2.4 and below.

Vulnerability Type: (Blind) SQL Injection

Severity: HIGH

Problem Description: Failing to properly sanitize user-supplied input, the extension is open to SQL Injection attacks. In case the "personalized salutations" frontend plugin is used, any website user could exploit this vulnerability.

Solution: Versions of this extension that are known to be vulnerable will no longer be available for download from the TYPO3 Extension Repository. At the time of writing, we don't know of a security update of the extension regarding the existing vulnerability, since we have been unable to get in contact with the author. For the time being please uninstall this extension and delete all files belonging to it from your TYPO3 installation.

General advice: Follow the recommendations that are given in the TYPO3 SECURITY Guide. Please subscribe to the typo3-announce mailing list to receive future Security Bulletins via E-mail.

Credits: Credits go to Mario Rimann who discovered and reported the issue.