SQL Injection Affecting pimcore/pimcore package, versions <12.3.6

pimcore/pimcore is a content & product management framework (CMS/PIM/E-Commerce).

Affected versions of this package are vulnerable to SQL Injection in the columnConfigAction process. An attacker can access and manipulate sensitive database information, as well as modify or delete data, by submitting crafted configuration payloads that are concatenated into SQL queries without proper parameterization. This allows unauthorized access to database contents and the ability to bypass weak input filtering using permitted SQL statements or comment-based evasion techniques. Error messages returned in JSON responses further facilitate data exfiltration through error-based techniques. This is only exploitable if the attacker has the reports_config permission.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release