Description

When performing a fulltext search in SilverStripe 4.0.0 the 'start' querystring parameter is never escaped safely. This exposes a possible SQL injection vulnerability. The issue exists in 3.5 and 3.6 but is less vulnerable, as SearchForm sanitises these variables prior to passing to mysql.

Description source: GitHub Advisory

Affected products and versions

1
ProductSourceVersion rangeStatus
GitHub Advisory3.5.0-rc1 to < 3.5.6 · Fixed in 3.5.6affected
3.6.0-rc1 to < 3.6.3 · Fixed in 3.6.3affected
4.0.0-rc1 to < 4.0.1 · Fixed in 4.0.1affected

References

5