CVE-2018-14058 (MEDIUM 6.5) · Watchpost

← All vulnerabilities

Pimcore SQLi Vulnerability

MEDIUM 6.5CVE-2018-14058 · GHSA-q4hw-c66h-4xqc · Published 17/08/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
pimcore/pimcore Packagist	`< 5.3.0`	`5.3.0`
pimcore pimcore	`< 5.3.0`	`5.3.0`

Description

Pimcore before 5.3.0 allows SQL Injection via the REST web service API.

NVD description

Pimcore before 5.3.0 allows SQL Injection via the REST web service API.

References

nvd.nist.gov/vuln/detail/CVE-2018-14058 · ADVISORY
exploit-db.com/exploits/45208 · WEB
sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software · WEB
packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html · WEB
seclists.org/fulldisclosure/2018/Aug/13 · WEB
exploit-db.com/exploits/45208 · Exploit
sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free