CVE-2018-14058

This Metasploit module exploits a SQL injection vulnerability in Pimcore's REST API to extract usernames and hashed passwords. It uses a UNION-based SQLi to retrieve credentials from the users table.

This is a security advisory detailing SQL injection, XSS, and CSRF vulnerabilities in Pimcore versions 5.2.3 and below. It includes proof-of-concept URLs and descriptions of the vulnerabilities but does not contain executable exploit code.