| Package | Affected versions | Patched versions |
|---|---|---|
| contao/contao | ≥ 4.1.0, < 4.4.39≥ 4.5.0, < 4.7.5 | 4.4.394.7.5 |
| contao/core-bundle | ≥ 4.1.0, < 4.4.39≥ 4.5.0, < 4.7.5 | 4.4.394.7.5 |
| contao | ≥ 4.0.0, < 4.4.39≥ 4.5.0, < 4.7.5 | 4.4.394.7.5 |
David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free