GHSA-fpff-384j-vxq7

ghsaUSosv

Data leakage via SQL Injection in Pimcore

view advisory published 2019-12-02Licence: CC-BY-4.0

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10763US	medium6.5	0.87% (59th)	—	2019-11-18
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The…

references

External citations — patches, advisories, analysis.

https://blog.certimetergroup.com/it/articolo/security/sql_injection_in_pimcore_6.2.3WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-10763ADVISORY
https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-480391WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan