Extension Sgalinski Cookie Consent
Monthly
SQL injection in the Sgalinski Cookie Consent extension for TYPO3 allows authenticated backend users with access to the consent-history or statistics module to inject unvalidated sorting, grouping, and index options into a database query, enabling arbitrary database reads that can include backend and frontend password hashes. The issue is privilege-gated: it requires a backend account granted those specific module permissions and the review/statistics feature in use, and no public exploit code was identified at time of analysis.
Missing authorization in the JSON configuration import of the Sgalinski Cookie Consent extension for TYPO3 lets a non-administrator backend user who already has access to the module import settings that inject arbitrary scripts into the website frontend. The issue is CWE-862 and is scored 7.1, with the supplied vector requiring authenticated backend access (PR:L) and no user interaction. No public exploit or CISA KEV entry was identified at time of analysis.
Missing authorization in the Sgalinski Cookie Consent extension for TYPO3 allows any authenticated backend user, regardless of role or module permissions, to read cookie-consent history and statistics for any site in the installation. The exposure is limited to confidentiality of consent data and requires valid backend credentials, so it is primarily an insider or post-compromise risk rather than an unauthenticated attack path. No public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in the Sgalinski Cookie Consent extension for TYPO3 allows authenticated backend users with access to the consent-history or statistics module to inject unvalidated sorting, grouping, and index options into a database query, enabling arbitrary database reads that can include backend and frontend password hashes. The issue is privilege-gated: it requires a backend account granted those specific module permissions and the review/statistics feature in use, and no public exploit code was identified at time of analysis.
Missing authorization in the JSON configuration import of the Sgalinski Cookie Consent extension for TYPO3 lets a non-administrator backend user who already has access to the module import settings that inject arbitrary scripts into the website frontend. The issue is CWE-862 and is scored 7.1, with the supplied vector requiring authenticated backend access (PR:L) and no user interaction. No public exploit or CISA KEV entry was identified at time of analysis.
Missing authorization in the Sgalinski Cookie Consent extension for TYPO3 allows any authenticated backend user, regardless of role or module permissions, to read cookie-consent history and statistics for any site in the installation. The exposure is limited to confidentiality of consent data and requires valid backend credentials, so it is primarily an insider or post-compromise risk rather than an unauthenticated attack path. No public exploit code or confirmed active exploitation was identified at time of analysis.