SQL injection in RecyclebinController.php in pimcore/pimcore
Valid
Reported on
Mar 29th 2022
Description
From the code we can see that in line 122, the value is append to the sql query directly. The value can be from line 109. And from filter parameter .
so we can use the value data to inject the database.
if we set a wrong value. we can see the sql error from the log file .
Proof of Concept
"filterFullText=&page=1&start=0&limit=50&filter="+encodeURIComponent('[{"property":"path","type":"string","value":"1 %\' union select 1 # ","operator":"="}]')
Impact
Impact
This vulnerability is capable of steal the data
Occurrences
We are processing your report and will contact the
pimcore
team within 24 hours.
a year ago
We have contacted a member of the
pimcore
team and are waiting to hear back
a year ago
mylong modified the report
a year ago
We have sent a
follow up to the
pimcore
team.
We will try again in 7 days.
a year ago
We have sent a
fix follow up to the
pimcore
team.
We will try again in 7 days.
a year ago
RecyclebinController.php#L122
has been validated
Seems the 'property' parameter is not fixed. And there are several other points leads to sqli, should I raise a new issue or write it here.
to join this conversation