CVE-2018-14058: Pimcore SQLi Vulnerability

The vulnerability manifests in REST API endpoints (/asset-, /document-, /object-*) that accept 'condition' and 'id' parameters. These parameters flow directly into SQL query construction through the corresponding Listing classes' setCondition methods. The functions identified are: 1) Controller actions handling vulnerable API endpoints, 2) Model layer methods that directly incorporate user input into SQL queries without parameterization. High confidence comes from exploit documentation showing direct parameter injection and Pimcore's architecture patterns for REST handlers.