EDB-45208

PoC

Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery

view exploit source exploit_dbtype webappsauthor SEC Consultpublished 2018-08-16catalog exploit_db

exploited CVEs (3)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2018-14059US	medium5.4	3.12% (88th)	Exploit	2018-08-24
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties,…
CVE-2018-14058US	medium6.5	28.6% (98th)	Exploit	2018-08-17
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
CVE-2018-14057US	high8.8	3.29% (88th)	Exploit	2018-08-17
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the "…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.