www.rietberg.de

Bugsink: https://bugsink.cytrus.de/issues/issue/7ace2b95-935a-426e-9f7a-44d84acce96b/event/last/

Typ: NEW issue

Projekt: www-rietberg-de

Bugsink Alert

DateMalformedStringException: Failed to parse time string (2026-014Sx4Z6JC'; waitfor delay '0:0:15' -- -01) at position 8 (S): The timezone could not…

Automatisch erstellt durch n8n

KI-Analyse:

{
"cause": "User‑supplied input (likely a GET/POST parameter) that is passed directly to TYPO3’s DateTime handling without proper validation/sanitization. The malicious string "2026-014Sx4Z6JC'; waitfor delay '0:0:15' -- -01" is interpreted as a date/time value, causing DateTime::createFromFormat (or equivalent) to fail and throw a DateMalformedStringException when it tries to look up the timezone.",
"fix": "Validate and sanitize any input that will be converted to a DateTime before it reaches the core. In Extbase actions, add a validator (e.g., @TYPO3\CMS\Extbase\Annotation\Validate("DateTime")) or use a DataMapper/TypeConverter that catches DateMalformedStringException and returns a sensible error. Alternatively, apply a whitelist regex (e.g., /^\d{4}-\d{2}-\d{2}$/) to the parameter in the controller or via a PSR‑15 middleware before routing. Ensure that user input is never concatenated directly into SQL queries; use Doctrine DBAL query builder or prepared statements.",
"affected_extension": "The specific extension cannot be seen in the stack trace, but the error originates from an Extbase plugin (or any custom controller) that defines a DateTime argument without validation. Typical candidates are custom extensions or third‑party extensions that handle date/time fields (e.g., news, calendar, sr_feuser_register, or any own extension with a DateTime property).",
"confidence": 80
}