CVE-2014-7201

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-10-10 · updated 2026-06-17
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via the (1) education, (2) region, or (3) sector fields, as demonstrated by the tx_dmmjobcontrol_pi1[search][sector][] parameter to jobs/.

Affected products

Kevin Renskers Dmmjobcontrol: through 2.14.0

References

http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html
http://seclists.org/fulldisclosure/2014/Sep/89
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012
http://www.securityfocus.com/bid/70155
https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt
http://packetstormsecurity.com/files/128446/Typo3-JobControl-2.14.0-Cross-Site-Scripting-SQL-Injection.html
http://seclists.org/fulldisclosure/2014/Sep/89
http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-012
http://www.securityfocus.com/bid/70155
https://www.mogwaisecurity.de/advisories/MSA-2014-02.txt

Get alerted when CVE-2014-7201 or the next vulnerability affects your stack