SQL injection in DTML or in connection objects

by Maurits van Rees published 2020/01/21 15:36:00 GMT+0, last modified 2020-01-24T13:29:41+00:00

Versions affected

  • 5.2.1
  • 5.2.0
  • 5.1.6
  • 5.1.5
  • 5.1.4
  • 5.1.2
  • 5.1.1
  • 5.1
  • 5.1rc2
  • 5.1rc1
  • 5.1b4
  • 5.1b3
  • 5.1b2
  • 5.1a2
  • 5.1a1
  • 5.0.10
  • 5.0.9
  • 5.0.8
  • 5.0.7
  • 5.0.6
  • 5.0.5
  • 5.0.4
  • 5.0.3
  • 5.0.2
  • 5.0.1
  • 5.0
  • 5.0rc3
  • 5.0rc2
  • 5.0rc1
  • 4.3.19
  • 4.3.18
  • 4.3.17
  • 4.3.15
  • 4.3.14
  • 4.3.12
  • 4.3.11
  • 4.3.10
  • 4.3.9
  • 4.3.8
  • 4.3.7
  • 4.3.6
  • 4.3.5
  • 4.3.4
  • 4.3.3
  • 4.3.2
  • 4.3.1
  • 4.3
  • 4.2.7
  • 4.2.6
  • 4.2.5
  • 4.2.4
  • 4.2.3
  • 4.2.2
  • 4.2.1
  • 4.2
  • 4.1.6
  • 4.1.5
  • 4.1.4
  • 4.1.3
  • 4.1.2
  • 4.1.1
  • 4.1
  • 4.0.10
  • 4.0.9
  • 4.0.8
  • 4.0.7
  • 4.0.5
  • 4.0.4
  • 4.0.3
  • 4.0.2
  • 4.0.1
  • 4.0

Vulnerability

SQL quoting in DTML or in connection objects was insufficient, leading to possible SQL injections. RelStorage is not affected. This is a problem in Zope. This hotfix will be sufficient to patch Zope sites that don't use Plone. Note that there is code in Plone that connects to an SQL database, this is only exploitable on highly customised sites.

Current status

Patched

Credits

Discovered by

  • Michael Brunnbauer
  • Michael Howitz

Fixed by

  • Michael Brunnbauer
  • Michael Howitz

Coordinated by

  • Plone Security Team