Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
CVE-2024-23646

8.8HIGH

Key Information:

Vendor

Pimcore
Status
Admin-ui-classic-bundle
Vendor
CVE Published:
24 January 2024

What is CVE-2024-23646?

The Pimcore Admin Classic Bundle, a backend interface for managing site files, suffers from a SQL Injection vulnerability due to improper validation of the selectedIds parameter in versions prior to 1.3.2. Any backend user with minimal permissions can leverage this vulnerability to execute arbitrary SQL commands, potentially allowing unauthorized access to sensitive data, modification of existing records, or elevation of their privileges to an administrative level. The issue has been resolved in version 1.3.2, which implements necessary input sanitization measures to prevent such exploitation.

Affected Version(s)

admin-ui-classic-bundle >= 1.0.0, < 1.3.2

References

https://github.com/pimcore/admin-ui-classic-bundle/securi...
x_refsource_CONFIRM
https://github.com/pimcore/admin-ui-classic-bundle/commit...
x_refsource_MISC
https://github.com/pimcore/admin-ui-classic-bundle/blob/1...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-23646 : Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip