CVE-2022-29600
📋 TL;DR
CVE-2022-29600 is a SQL injection vulnerability in the oelib extension for TYPO3 CMS. It allows attackers to execute arbitrary SQL commands through crafted inputs, potentially compromising database integrity and confidentiality. All TYPO3 installations using affected versions of the oelib extension are vulnerable.
💻 Affected Systems
- TYPO3 CMS with oelib extension
📦 What is this software?
Oelib by Oliverklee
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, modification, or deletion from the TYPO3 database.
If Mitigated
Limited impact with proper input validation and database permissions in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited. The advisory provides technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: oelib extension version 4.1.6 or later
Vendor Advisory: https://typo3.org/security/advisory/typo3-ext-sa-2022-007
Restart Required: No
Instructions:
1. Update oelib extension to version 4.1.6 or later via TYPO3 Extension Manager. 2. Clear all caches in TYPO3 backend. 3. Test functionality of sites using oelib features.
🔧 Temporary Workarounds
Disable oelib extension
allTemporarily disable the vulnerable extension until patching is possible.
typo3cms extension:deactivate oelib
Implement WAF rules
allAdd SQL injection detection rules to web application firewall.
🧯 If You Can't Patch
- Restrict database user permissions to minimum required operations
- Implement network segmentation to isolate TYPO3 database from other systems
🔍 How to Verify
Check if Vulnerable:
Check installed oelib extension version in TYPO3 Extension Manager or via composer show oelib/oelibCheck Version:
composer show oelib/oelib | grep versionVerify Fix Applied:
Confirm oelib extension version is 4.1.6 or higher and test SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- SQL syntax in HTTP parameters
- Unusual database connection patterns
SIEM Query:
web_logs WHERE (url CONTAINS "' OR" OR url CONTAINS "' UNION" OR url CONTAINS "' SELECT") AND url CONTAINS "oelib"