| Package | Affected versions | Patched versions |
|---|---|---|
| pimcore/pimcore | < 10.6.4 | 10.6.4 |
| pimcore | < 10.6.4 | 10.6.4 |
Using some SQL exploitation tools such as sqlmap, an attacker can enumerate all information in the database, alter data or perform dos on the backend database.
Update to version 10.6.5 or apply this patch manually https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch
Apply patch https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch manually.
https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db/
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free