SB2024012489 - SQL injection in Pimcore admin-ui-classic-bundle

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024012489

SB2024012489 - SQL injection in Pimcore admin-ui-classic-bundle

Published: January 24, 2024 Updated: July 22, 2026

Security Bulletin ID SB2024012489
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) SQL injection (CVE-ID: CVE-2024-23646)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary SQL statements and escalate privileges.

The vulnerability exists due to SQL injection in the downloadAsZipAddFilesAction endpoint when handling the selectedIds parameter in requests to add files to a zip job. A remote user can send a specially crafted request to execute arbitrary SQL statements and escalate privileges.

The issue affects backend functionality and can be exploited by a logged-in backend user with very basic permissions.


Remediation

Install update from vendor's website.

References