Daniel Windloff

An issue exists where manipulation of the `defVals` parameter can bypass field-level access checks during record creation within the TYPO3 backend. Successful exploitation allows attackers to insert arbitrary data into restricted fields of a database table, provided the user already possesses write permissions for a limited set of fields.

Backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, irrespective of their permissions for that specific table. This allowed attackers to purge and destroy critical site data, potentially rendering the website unavailable. The issue concerns the TYPO3 CMS recycler module and its interaction with the TCA (TypoScript Configuration Array).

An issue has been discovered in the classes QueryGenerator and QueryView, which are vulnerable to insecure deserialization. There are two exploitable scenarios: one requires the system extension ext:lowlevel (Backend Module: DB Check) to be installed, with a valid backend user having administrator privileges, and the other requires the system extension ext:sys action to be installed, with a valid backend user having limited privileges.