Dvesh3

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 11.1.1 **Description** The issue allows backend users with basic permissions to execute arbitrary SQL statements by passing input directly into an SQL statement through the `/admin/object/grid-proxy` endpoint. This is due to the `getFilterCondition()` function, specifically in the `Multiselect` implementation, not normalizing, escaping, or validating the passed value. As a result, any backend user can alter data or escalate their privileges to at least admin level. There are no known workarounds for this issue. **Recommendations** For versions prior to 11.1.1, update to version 11.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the `/admin/object/grid-proxy` endpoint and the `Multiselect` field to minimize the risk of exploitation. Avoid using the `filter` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.18 **Description** Pimcore is an open source data and experience management platform. The impact of this path traversal and arbitrary extension is limited to creation of arbitrary files and appending data to existing files. When combined with SQL Injection, the exported data can be controlled and a webshell can be uploaded, allowing attackers to execute arbitrary PHP code on the server with the permissions of the webserver. **Recommendations** To resolve the issue, users may upgrade to version 10.5.18 to receive a patch. As a workaround, apply the patch manually. Restrict access to sensitive data and server permissions to minimize the risk of exploitation until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.21 **Description** Pimcore is an open source data and experience management platform. The `/admin/misc/script-proxy` API endpoint, accessible by an authenticated administrator user, is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the `scriptPath` parameter and the file name in the `scripts` parameter. The JavaScript file is successfully read only if the web application has read access to it. **Recommendations** Update to version 10.5.21 to receive a patch. As a workaround, apply the patch manually. Restrict access to the `/admin/misc/script-proxy` API endpoint until the issue is resolved. Avoid using the `scriptPath` and `scripts` parameters in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.21 **Description** Pimcore is an open source data and experience management platform. A SQL Injection issue exists in the admin translations API, allowing an attacker to interfere with database queries, potentially viewing, modifying, or deleting data. The API endpoint is accessible by an authenticated administrator user and is vulnerable to SQL injection via the `filter` POST parameter, specifically through the `property` key in the JSON formatted data, which is not properly sanitized. This could lead to persistent changes in the application's content or behavior and potentially compromise the underlying server. **Recommendations** For versions prior to 10.5.21, update to version 10.5.21 to receive a patch. As a temporary workaround, consider applying the patch manually. Restrict access to the admin translations API endpoint to minimize the risk of exploitation. Avoid using the `filter` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.21 **Description** A SQL injection vulnerability exists in the translation export API, allowing an attacker to interfere with the queries that the application makes to its database. This can enable an attacker to view data that they are not normally able to retrieve, modify or delete this data, causing persistent changes to the application's content or behavior. The vulnerability is accessible via the "filter" GET parameter in a specific API endpoint, where the value of the JSON key `property` inside `filter` is not sanitized properly and is used in a SQL statement in an unsafe manner. **Recommendations** Update to version 10.5.21 to receive a patch. As a temporary workaround, apply the patch manually to fix the SQL injection vulnerability in the translation export API. Restrict access to the vulnerable API endpoint until the issue is resolved. Avoid using the `property` key inside the `filter` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.19 **Description** Pimcore is an open source data and experience management platform. There is a theoretical possibility to inject custom SQL if the developer is using certain methods with input data and not doing proper input validation in advance, relying on the auto-quoting being done by the DAO class. **Recommendations** For versions prior to 10.5.19, update to version 10.5.19 to receive a patch. As a workaround for versions prior to 10.5.19, apply the patch manually.

**Name of the Vulnerable Software and Affected Versions** Pimcore versions prior to 10.5.16 **Description** The upload functionality for updating user profiles does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (e.g., GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. **Recommendations** For versions prior to 10.5.16, update to version 10.5.16 to resolve the issue. As a temporary workaround, consider restricting the upload functionality for updating user profiles until the update is applied.

**Name of the Vulnerable Software and Affected Versions** pimcore/pimcore versions prior to 10.5.6 **Description** The issue is related to stored Cross-site Scripting (XSS) in the pimcore/pimcore GitHub repository. This occurs when an attacker injects a payload, for example, when adding properties for a new user. **Recommendations** For versions prior to 10.5.6, update to version 10.5.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** pimcore/pimcore versions prior to 10.2.10 **Description** The issue is related to a Cross-site Scripting (XSS) - Stored vulnerability in the GitHub repository pimcore/pimcore. This type of vulnerability allows an attacker to inject malicious scripts into a website, which can then be executed by other users. **Recommendations** For versions prior to 10.2.10, update to version 10.2.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** pimcore/pimcore versions prior to 10.2.9 **Description** The issue is related to Cross-site Scripting (XSS) - Stored. This means that an attacker can inject malicious scripts into the website, which will be executed by the user's browser. The estimated number of potentially affected devices worldwide is not available. **Recommendations** For versions prior to 10.2.9, update to version 10.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** pimcore (affected versions not specified) **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software fails to properly neutralize user input, allowing an attacker to inject malicious code into web pages. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pimcore (affected versions not specified) **Description** The issue is related to Cross-Site Request Forgery (CSRF), which is a type of attack that tricks a user into performing unintended actions on a web application. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pimcore (affected versions not specified) **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for the injection of malicious scripts into web pages generated by pimcore. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.