A backend module in the TYPO3 sgalinski Cookie Consent extension builds a SQL query from sorting, grouping and index parameters received in a request. Only the filter conditions of the query are parameterised, while the remaining clauses are inserted directly. An attacker can supply crafted values for these parameters to manipulate the query and extract data from the database. The vulnerability allows a backend user with access to the history or statistics functions to read arbitrary rows, including sensitive values such as password hashes of both backend and frontend users. Based on the description, it is inferred that the flaw permits arbitrary SQL injection when a backend user supplies malicious sorting, grouping, or index values.

TYPO3 Extension - sgalinski Cookie Consent (sg_cookie_optin). Specific version numbers are not listed in the advisory, so any deployment of this extension is potentially vulnerable unless a non-affected release has been confirmed. The impact applies to systems that have the extension installed and whose backend users possess access to the history or statistics interfaces. The likely attack vector is an attacker who can log into a backend account with permission to access these interfaces.

The CVSS score of 7.1 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, and the issue is not listed in the CISA KEV catalog. Nevertheless, the vulnerability requires a legitimate backend session with the appropriate permissions; therefore, compromising a backend account or exploiting social engineering on such an account would enable the attacker to weaponise the flaw. Once sufficient access is obtained, the attacker can execute the injection to gain full read exposure of database contents, which could lead to credential theft and further lateral movement. The likely attack vector is a valid backend session that has been compromised or granted the necessary access.