Unscored severity · published Nov 27, 2013
CVE-2013-5957
Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the _value parameter to (1) ajax/jqState or (2) ajax/jqcounty.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Civicrm · Civicrm
4.4; 4.4; 4.4; 4.4; 4.4.0; 4.4.0; +18 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-5957
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-5957
Patch
https://civicrm.org/advisory/civi-sa-2013-009-sql-injection-vulnerability
Patch
https://github.com/civicrm/civicrm-core/pull/1708.diff
Exploit
https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerability-in-civicrm-cve-2013-5957.html
www.navixia.com
https://www.navixia.com/company/navixia-news/395-navixia-finds-critical-vulnerability-in-civicrm.html
More from Civicrm
9.8
CVE-2018-1999022
PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method,…
8.8
CVE-2026-72558
CiviCRM CiviCRM - SQL Injection
8.8
CVE-2020-36388
In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive
6.1
CVE-2025-65187
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field
5.4
CVE-2023-25440
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field