CVE-2013-5957

Published: Nov 27, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the _value parameter to (1) ajax/jqState or (2) ajax/jqcounty.

Affected (24)

Products: Civicrm: Civicrm

Civicrm

1 product

Civicrm

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Civicrm Civicrm	Version 4.4.0 alpha1
Civicrm Civicrm	Version 4.4.0 alpha2
Civicrm Civicrm	Version 4.4 alpha3
Civicrm Civicrm	Version 4.4 beta1
Civicrm Civicrm	Version 4.4 beta2
Civicrm Civicrm	Version 4.4 beta3

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Civicrm Civicrm	Up to 4.2.11
Civicrm Civicrm	Version 4.2.0
Civicrm Civicrm	Version 4.2.10
Civicrm Civicrm	Version 4.2.1
Civicrm Civicrm	Version 4.2.2
Civicrm Civicrm	Version 4.2.4
Civicrm Civicrm	Version 4.2.5
Civicrm Civicrm	Version 4.2.6
Civicrm Civicrm	Version 4.2.7
Civicrm Civicrm	Version 4.2.8
Civicrm Civicrm	Version 4.2.9

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Civicrm Civicrm	Version 4.3.0
Civicrm Civicrm	Version 4.3.1
Civicrm Civicrm	Version 4.3.2
Civicrm Civicrm	Version 4.3.3
Civicrm Civicrm	Version 4.3.4
Civicrm Civicrm	Version 4.3.5
Civicrm Civicrm	Version 4.3.6