PT-2023-23003 · Pimcore · Pimcore

Highdvesh3 · Published 2023-04-27 · Updated 2026-01-20 · CVE-2023-30848

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.5.21

Description The issue is related to a SQL injection vulnerability in the admin search find API. This vulnerability allows an attacker to interfere with the queries that the application makes to its database, potentially viewing data they are not normally able to retrieve, modifying or deleting data, and causing persistent changes to the application's content or behavior. The vulnerability is accessible via the "fields[]" GET parameter in the API endpoint, which is not sanitized properly and is used in a SQL statement in an unsafe manner.

Recommendations For versions prior to 10.5.21, update to version 10.5.21 to receive a patch. As a temporary workaround, apply the patch manually. Restrict access to the vulnerable API endpoint until the issue is resolved. Avoid using the fields[] parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-30848

GHSA-6MHM-GCPF-5GR8

Affected Products

Pimcore

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30848.json · Exploit
• https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch · Patch
• https://github.com/pimcore/pimcore/pull/14972 · Vendor Advisory
• https://github.com/pimcore/pimcore/security/advisories/GHSA-6mhm-gcpf-5gr8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30848 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30848 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6mhm-gcpf-5gr8 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3 · Note
• https://twitter.com/dailycve/status/2011559269720867182 · Twitter Post
• https://t.me/cibsecurity/62992 · Telegram Post
• https://t.me/cveNotify/149346 · Telegram Post