The TYPO3 Extension "Address List" contains a SQL Injection vulnerability (CWE-89) in the AddressRepository::getSqlQuery() method due to improper neutralization of special elements in SQL commands. Although the vulnerable method is present, it is not invoked internally by the extension itself, meaning the default installation is not directly exploitable. Custom extensions that call this method with unsanitized, untrusted input could trigger SQL injection, allowing an attacker to manipulate database queries. The vulnerability affects specific versions including 0, 9.0.0, and 10.0.0 of the extension. No official patch or remediation level has been published yet.

If exploited via a custom extension that calls the vulnerable method with untrusted input, an attacker could perform SQL injection attacks, potentially leading to unauthorized data access or manipulation. Since the vulnerable method is not used by the extension itself, default installations are not directly impacted. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerable method is not called in the default extension, no immediate action is required for default installations. Developers creating custom extensions should avoid calling AddressRepository::getSqlQuery() with untrusted input or implement proper input sanitization to prevent SQL injection.