SQL injection in DTML or in connection objects
Versions affected
- 5.2.1
- 5.2.0
- 5.1.6
- 5.1.5
- 5.1.4
- 5.1.2
- 5.1.1
- 5.1
- 5.1rc2
- 5.1rc1
- 5.1b4
- 5.1b3
- 5.1b2
- 5.1a2
- 5.1a1
- 5.0.10
- 5.0.9
- 5.0.8
- 5.0.7
- 5.0.6
- 5.0.5
- 5.0.4
- 5.0.3
- 5.0.2
- 5.0.1
- 5.0
- 5.0rc3
- 5.0rc2
- 5.0rc1
- 4.3.19
- 4.3.18
- 4.3.17
- 4.3.15
- 4.3.14
- 4.3.12
- 4.3.11
- 4.3.10
- 4.3.9
- 4.3.8
- 4.3.7
- 4.3.6
- 4.3.5
- 4.3.4
- 4.3.3
- 4.3.2
- 4.3.1
- 4.3
- 4.2.7
- 4.2.6
- 4.2.5
- 4.2.4
- 4.2.3
- 4.2.2
- 4.2.1
- 4.2
- 4.1.6
- 4.1.5
- 4.1.4
- 4.1.3
- 4.1.2
- 4.1.1
- 4.1
- 4.0.10
- 4.0.9
- 4.0.8
- 4.0.7
- 4.0.5
- 4.0.4
- 4.0.3
- 4.0.2
- 4.0.1
- 4.0
Vulnerability
SQL quoting in DTML or in connection objects was insufficient, leading to possible SQL injections. RelStorage is not affected.
This is a problem in Zope. This hotfix will be sufficient to patch Zope sites that don't use Plone.
Note that there is code in Plone that connects to an SQL database, this is only exploitable on highly customised sites.
Current status
Patched
Credits
Discovered by
- Michael Brunnbauer
- Michael Howitz
Fixed by
- Michael Brunnbauer
- Michael Howitz
Coordinated by
- Plone Security Team