| Package | Affected versions | Patched versions |
|---|---|---|
| civicrm/civicrm-core | ≥ 4.2.0, < 4.2.9≥ 4.3.0, < 4.3.3 | 4.2.94.3.3 |
| civicrm | = 4.2.0= 4.2.1= 4.2.2= 4.2.4= 4.2.5= 4.2.6= 4.2.7= 4.2.8= 4.2.9= 4.3.0= 4.3.1= 4.3.2= 4.3.3 |
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free