Vulnerability record · CVE-2013-5957 · published 27 November 2013

CVE-2013-5957: Civicrm sql injection vulnerability

Civicrm · Civicrm

Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the _value parameter to (1) ajax/jqState or (2) ajax/jqcounty.

7.5 CVSS 2.0 High EPSS 2.1% · top 19.2% CWE-89 · SQL injection

7.5CVSS 2.0 base score

2.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 2 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Civicrm Civicrm

References

Link	Tags
https://civicrm.org/advisory/civi-sa-2013-009-sql-injection-vulnerability	PatchVendor Advisory
https://github.com/civicrm/civicrm-core/pull/1708.diff	Patch
https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerability-in-civicrm-cve-2013-5957.html	Exploit
https://www.navixia.com/company/navixia-news/395-navixia-finds-critical-vulnerability-in-civicrm.html
https://civicrm.org/advisory/civi-sa-2013-009-sql-injection-vulnerability	PatchVendor Advisory
https://github.com/civicrm/civicrm-core/pull/1708.diff	Patch
https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerability-in-civicrm-cve-2013-5957.html	Exploit
https://www.navixia.com/company/navixia-news/395-navixia-finds-critical-vulnerability-in-civicrm.html

Track CVE-2013-5957 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-1999022Html quickform project html quickform code injection vulnerabilityPEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's vali…EPSS 2.2%23 Jul 2018 8.8CVE-2020-36388Civicrm unrestricted file upload vulnerabilityIn CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.EPSS 1.5%17 Jun 2021 6.5CVE-2013-4662Civicrm sql injection vulnerabilityThe Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and cond…EPSS 1.0%29 Jan 2014 6.1CVE-2025-65187Civicrm cross-site scripting vulnerabilityA Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious…EPSS 0.22%2 Dec 2025 5.8CVE-2011-5239Civicrm improper input validation vulnerabilityCiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of t…EPSS 0.53%6 Nov 2012 5.4CVE-2023-25440Civicrm cross-site scripting vulnerabilityStored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/…EPSS 2.5%23 May 2023 4.9CVE-2013-4661Civicrm permissions and access controls vulnerabilityCiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom search…EPSS 0.99%29 Jan 2014 4.3CVE-2020-36389Civicrm cross-site request forgery vulnerabilityIn CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.EPSS 0.66%17 Jun 2021

Source: NIST National Vulnerability Database (record CVE-2013-5957), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.