SQL injection in Pimcore admin-ui-classic-bundle - CVE-2024-23646
Published: January 24, 2024 / Updated: July 22, 2026
Vulnerability identifier: #VU139123
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2024-23646
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Pimcore
Affected software:
Pimcore admin-ui-classic-bundle
Pimcore admin-ui-classic-bundle
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary SQL statements and escalate privileges.
The vulnerability exists due to SQL injection in the downloadAsZipAddFilesAction endpoint when handling the selectedIds parameter in requests to add files to a zip job. A remote user can send a specially crafted request to execute arbitrary SQL statements and escalate privileges.
The issue affects backend functionality and can be exploited by a logged-in backend user with very basic permissions.
How to mitigate CVE-2024-23646
Install security update from vendor's website.