Sgalinski Cookie Consent CVE-2026-112064

Requires an authenticated TYPO3 backend account that has been granted access to the consent history or statistics functions of the sgalinski Cookie Consent extension (PR:L). The attacker supplies manipulated sorting, grouping, or index options in the request to the consent-history review backend module; these inputs are placed into the SQL query without validation while only filter conditions are bound as parameters. Limiting factors: exploitation is impossible for anonymous/frontend-only users and for backend users without rights to the history/statistics module, so risk scales with how widely those backend permissions are delegated; it also requires the extension to be installed and the review/statistics feature in use.

This is a credible but privilege-gated SQL injection (CWE-89) in the sgalinski Cookie Consent extension for TYPO3. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) confirms a network-reachable, low-complexity attack that requires low-level privileges (PR:L) - i.e., an authenticated backend user who already holds access to the consent history or statistics functions. The 7.1 score is driven entirely by confidentiality impact (VC:H), with no integrity or availability effect, which matches a read-oriented injection capable of extracting arbitrary data including backend and frontend password hashes. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the input, so real-world exploitation signals are absent: no public exploit identified at time of analysis. The practical ceiling on risk is the PR:L precondition - this is not an unauthenticated internet-wide threat but an insider/privilege-escalation and post-compromise data-exfiltration primitive. Net assessment: a genuine priority for TYPO3 installations running this specific extension where backend access is broadly delegated, but materially lower urgency than the raw 7.1 suggests for hardened sites with tightly controlled backend accounts. No conflicting signals were found between the CVSS vector and the description; both consistently indicate authenticated-remote, confidentiality-only impact.

A backend user who has been granted access to the consent history or statistics module submits a request with crafted sorting, grouping, or index parameters that are concatenated into the database query without validation. Because only the filter conditions are parameter-bound, the injected clauses execute, letting the attacker pivot the query to read arbitrary tables and dump backend and frontend password hashes for offline cracking. No public exploit code is identified at time of analysis, and the attacker must already hold a privileged backend account.