PT-2023-23003 · Pimcore · Pimcore
Highdvesh3
·
Publicado
2023-04-27
·
Atualizado
2026-01-20
·
CVE-2023-30848
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Pimcore versions prior to 10.5.21
Description
The issue is related to a SQL injection vulnerability in the admin search find API. This vulnerability allows an attacker to interfere with the queries that the application makes to its database, potentially viewing data they are not normally able to retrieve, modifying or deleting data, and causing persistent changes to the application's content or behavior. The vulnerability is accessible via the "fields[]" GET parameter in the API endpoint, which is not sanitized properly and is used in a SQL statement in an unsafe manner.
Recommendations
For versions prior to 10.5.21, update to version 10.5.21 to receive a patch.
As a temporary workaround, apply the patch manually.
Restrict access to the vulnerable API endpoint until the issue is resolved.
Avoid using the
fields[] parameter in the affected API endpoint until the issue is resolved.Exploit
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Pimcore