CyberRota Analysis
AI-GeneratedAn SQL injection vulnerability in the Pimcore admin-ui-classic-bundle allows authenticated backend users to manipulate SQL queries via the DataObject grid id column filter, which is improperly parameterized. This flaw enables attackers with backend access to exfiltrate or modify the entire database contents, posing a significant risk to data integrity and confidentiality. Organizations using this version of Pimcore should prioritize remediation to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.