CVE-2009-4702 in Pm Tour
Summary
by MITRE
SQL injection vulnerability in the Tour Extension (pm_tour) extension before 0.0.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/02/2026
The CVE-2009-4702 vulnerability represents a critical SQL injection flaw within the Tour Extension (pm_tour) for TYPO3 systems prior to version 0.0.13. This vulnerability resides in the Tour Extension module which is designed to provide interactive tour functionality for TYPO3 content management systems. The flaw enables remote attackers to inject malicious SQL commands through unspecified input vectors, potentially allowing full database access and arbitrary code execution. The vulnerability specifically affects TYPO3 installations that utilize this extension, creating a significant security risk for organizations relying on the platform for their web content management needs.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the Tour Extension's database query construction mechanisms. Attackers can exploit this weakness by crafting malicious input parameters that are directly incorporated into SQL statements without proper escaping or parameterization. This allows threat actors to manipulate database queries and execute unauthorized commands against the underlying database system. The unspecified vectors suggest that multiple input points within the extension could potentially be exploited, making the attack surface broader than initially apparent. The vulnerability aligns with CWE-89 which categorizes SQL injection flaws as weaknesses in software that allows attackers to manipulate database queries through untrusted input.
The operational impact of this vulnerability extends beyond simple data theft, as successful exploitation could lead to complete system compromise and unauthorized access to sensitive organizational data. Remote attackers could potentially extract database contents, modify or delete information, create new database users with elevated privileges, or even escalate their access to the underlying operating system. This vulnerability directly violates fundamental security principles of input validation and proper database query construction, creating a persistent threat vector that could be exploited by automated scanning tools or determined attackers. Organizations using affected TYPO3 versions may face regulatory compliance violations and significant reputational damage if data breaches occur as a result of this vulnerability.
Mitigation strategies for CVE-2009-4702 require immediate patching of the Tour Extension to version 0.0.13 or later, which contains the necessary security fixes to prevent SQL injection attacks. Organizations should also implement network-level protections such as web application firewalls to detect and block suspicious SQL injection attempts. Database access controls should be reviewed to ensure that application accounts have minimal necessary privileges, following the principle of least privilege. Input validation should be strengthened at multiple layers including application code, database level, and network infrastructure. Security monitoring should be enhanced to detect anomalous database access patterns that might indicate exploitation attempts. The vulnerability demonstrates the importance of keeping all CMS extensions updated and following secure coding practices such as parameterized queries and input sanitization, which are fundamental requirements of the OWASP Top Ten security framework and align with ATT&CK technique T1071.004 for application layer attacks. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses in other extensions or custom code within the TYPO3 environment.