Secunia

Multiple vulnerabilities have been reported in various TYPO3 extensions, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.

1) Certain unspecified input passed to the TARGET-E WorldCup Bets (worldcup), TIMTAB (timtab_sociable), Download system (sb_downloader), JobControl (dmmjobcontrol), and CoolURI (cooluri) extensions is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Certain unspecified input passed to the TARGET-E WorldCup Bets (worldcup), and JobControl (dmmjobcontrol) extensions is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution
Update to a fixed version. See vendor advisory for details.

Provided and/or discovered by
The vendor credits Martin Holtz, Marcus Krause, Dmitry Dulepov, Georg Ringer, Marc Bastian Heinrichs, and Jigal van Hemert.

Changelog
Further details available in Customer Area

Original Advisory
http://typo3.org/teams/security/security-bulletins/typo3-20080619-1/

Deep Links
Links available in Customer Area