CVE-2012-1071: SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remo...

Security readout for executives and security teams

This is an old SQL injection issue in the TYPO3 Kitchen recipe extension, mv_cooking, before version 0.4.1. A remote attacker could manipulate database queries, potentially exposing or changing site data. The CVE record says it was exploited in the wild in February 2012. Exposure is likely limited to legacy TYPO3 sites that installed the Kitchen recipe mv_cooking extension before 0.4.1. Internet-facing TYPO3 deployments are the main concern. Sites without this extension are not indicated as affected by the provided sources. Prioritize remediation where old TYPO3 sites remain public-facing or handle valuable data. The vulnerability is dated, but SQL injection plus cited in-the-wild exploitation makes unpatched legacy exposure a meaningful business risk. Mitigation focus: Inventory TYPO3 sites for the mv_cooking extension and its installed version.; Upgrade mv_cooking to 0.4.1 or later if supported by TYPO3 guidance.; Disable or remove mv_cooking where it is unused or cannot be updated..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.