CVE-2026-112064: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in TYPO3 Extension "sgalinski Cookie Consent"

The TYPO3 extension "sgalinski Cookie Consent" contains a SQL Injection vulnerability (CWE-89) in its backend module for reviewing consent history. The module accepts sorting, grouping, and index options from user requests and incorporates them into database queries without proper validation or parameter binding. Only the filter conditions are parameterized, leaving the sorting and grouping vulnerable to injection. A backend user with access to history or statistics functions can exploit this to read arbitrary data from the database, including sensitive information such as password hashes of backend and frontend users. The vulnerability affects versions >=8.0.0 <8.1.7 and >=0 <7.4.6 of the extension. No vendor advisory or patch information is provided, so patch status is not confirmed.

An attacker with backend user privileges to the consent history or statistics functions can exploit this vulnerability to perform SQL Injection, enabling unauthorized reading of arbitrary database data. This includes sensitive data such as password hashes for backend and frontend users, potentially leading to credential compromise and further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict backend user access to the consent history and statistics functions to trusted personnel only. Monitor for updates from TYPO3 regarding patches or official fixes for this vulnerability.