The TYPO3 Extension "Forms Export" suffers from a SQL injection vulnerability (CWE-89) because it does not properly neutralize special elements in SQL commands. Specifically, user input passed through a URL parameter in the backend module is not sanitized before being used in database queries. Exploitation requires a low-privileged backend user with read access to the module, enabling injection of arbitrary SQL commands. Affected versions include =6.0.0, >=6.0.0 <6.1.3, <5.0.5, =7.0.0, and >=7.0.0 <7.1.1. No official patch or remediation level has been published yet.

An attacker with low-privileged backend access and read permissions to the "Forms Export" backend module can execute arbitrary SQL commands on the database. This can lead to unauthorized data access or modification within the scope of the database permissions. The vulnerability does not require user interaction beyond the attacker controlling the URL parameter. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend user permissions to limit access to the "Forms Export" backend module and monitor for suspicious activity. Avoid exposing this module to untrusted users. Follow TYPO3 vendor advisories for updates on patches or official mitigations.