Sebastian Nerz

The issue allows remote attackers to execute arbitrary SQL commands via the `device ID` REST parameter in the `/ajax.php` API endpoint, and also allows remote authenticated users to execute arbitrary SQL commands via the `order` parameter in the `index.php` endpoint.

The issue concerns the File Abstraction Layer (FAL) in TYPO3, which fails to properly check permissions. This allows remote authenticated users to create or read arbitrary files by crafting a specific URL.