CVE-2013-4662 json
CiviCRM SQL injection vulnerability via Quick Search API
published 12y ago modified 4mo ago also GHSA-4465-r2hg-v4rj , EUVD-2022-2290
- cvss
- 6.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
Patch / fix
- packagist civicrm/civicrm-core 4.2.9, 4.3.3
Is CVE-2013-4662 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | civicrm/civicrm-core | >=4.2.0, <4.2.9 >=4.3.0, <4.3.3 |
4.2.9 4.3.3 |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
civicrm.org
/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api
web, vendor-advisory
-
issues.civicrm.org
/jira/browse/CRM-12765
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2013-4662
advisory
-
github.com
/civicrm/civicrm-core
package
-
issues.civicrm.org
/jira/browse/CRM-12765
web
Sources
- CVE List CVE-2013-4662
- GitHub Advisory GHSA-4465-r2hg-v4rj
- NVD CVE-2013-4662
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.