CVE-2013-4662

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-29 · updated 2026-06-16
Weakness: CWE-89

Description

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.

Affected products

CiviCRM: 4.2.0, 4.2.1, 4.2.2, 4.2.4, 4.2.5, 4.2.6 (+7)

References

http://issues.civicrm.org/jira/browse/CRM-12765
https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api
http://issues.civicrm.org/jira/browse/CRM-12765
https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api

Get alerted when CVE-2013-4662 or the next vulnerability affects your stack