PT-2023-4112 · Pimcore · Pimcore

Kingjia90 · Published 2023-07-21 · Updated 2023-07-26 · CVE-2023-3820

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions prior to 10.6.4 pimcore/pimcore version 10.6.4 is not affected, the fixed version is 10.6.5

Description The issue is related to SQL injection in the pimcore/pimcore GitHub repository. This is due to a lack of protection measures for the SQL query structure. An attacker can exploit this issue to conduct SQL injection attacks remotely. Using SQL exploitation tools, such as sqlmap, an attacker can enumerate all information in the database, alter data, or perform a denial of service on the backend database.

Recommendations For pimcore/pimcore versions prior to 10.6.4, update to version 10.6.5 to resolve the issue. As a temporary workaround, apply the patch manually from https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch to mitigate the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-04421

CVE-2023-3820

GHSA-C9HW-557Q-F8HQ

Affected Products

Pimcore

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3820.json · Exploit
• 🔥 https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db · Exploit
• https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-3820 · Security Note
• https://osv.dev/vulnerability/GHSA-c9hw-557q-f8hq · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04421 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3820 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq · Note
• https://t.me/cibsecurity/67098 · Telegram Post