What’s Vulnerable › Vulnerabilities

CVE-2013-5957

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-11-27 · updated 2026-06-16
• Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the _value parameter to (1) ajax/jqState or (2) ajax/jqcounty.

Affected products

• CiviCRM: through 4.2.11; 4.4-alpha3, 4.4-beta1, 4.4-beta2, 4.4-beta3, 4.4.0-alpha1, 4.4.0-alpha2 (+17)

References

• https://civicrm.org/advisory/civi-sa-2013-009-sql-injection-vulnerability
• https://github.com/civicrm/civicrm-core/pull/1708.diff
• https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerability-in-civicrm-cve-2013-5957.html
• https://www.navixia.com/company/navixia-news/395-navixia-finds-critical-vulnerability-in-civicrm.html
• https://civicrm.org/advisory/civi-sa-2013-009-sql-injection-vulnerability
• https://github.com/civicrm/civicrm-core/pull/1708.diff
• https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerability-in-civicrm-cve-2013-5957.html
• https://www.navixia.com/company/navixia-news/395-navixia-finds-critical-vulnerability-in-civicrm.html

Get alerted when CVE-2013-5957 or the next vulnerability affects your stack