CyberRota Analysis
AI-GeneratedPimcore's Admin Classic Bundle is vulnerable to SQL injection in its translation grid date filter, allowing attackers to manipulate the user-supplied `property` field, which is directly interpolated into a SQL expression without proper validation. This vulnerability can lead to unauthorized data access or manipulation, posing a significant risk to the integrity of the database. Organizations using affected versions prior to 2.3.6 and 1.7.18 should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue.