Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

CVE-2024-23646

Summary

The Pimcore Admin Classic Bundle, a backend interface for managing site files, suffers from a SQL Injection vulnerability due to improper validation of the selectedIds parameter in versions prior to 1.3.2. Any backend user with minimal permissions can leverage this vulnerability to execute arbitrary SQL commands, potentially allowing unauthorized access to sensitive data, modification of existing records, or elevation of their privileges to an administrative level. The issue has been resolved in version 1.3.2, which implements necessary input sanitization measures to prevent such exploitation.

References