Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-3820

CVE-2023-3820: Pimcore vulnerable to SQL Injection in Dataobjects sorting

7.2

CVSS Score
3.0

Basic Information

CVE ID
CVE-2023-3820
GHSA ID
GHSA-c9hw-557q-f8hq
EPSS Score
0.96483%
CWE
CWE-89
Published
7/21/2023
Updated
11/5/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pimcore/pimcorecomposer< 10.6.410.6.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper SQL identifier quoting in the order key handling logic. The patch adds quoteIdentifier() calls to all order key components, proving the original code lacked necessary sanitization. The function prepareListingForGrid handles user-provided sorting parameters and directly interpolated them into SQL queries, making it the clear injection point. The high confidence comes from: 1) The CWE-89 classification, 2) The patch's focus on adding quoting in this function, and 3) The vulnerability's description tying exploitation to SQLi via sorting parameters.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Usin* som* SQL *xploit*tion tools su** *s sqlm*p, *n *tt**k*r **n *num*r*t* *ll in*orm*tion in t** **t***s*, *lt*r **t* or p*r*orm *os on t** ***k*n* **t***s*. ### P*t***s Up**t* to v*rsion **.*.* or *pply t*is p*t** m*nu*lly *ttps://*it*

Reasoning

T** vuln*r**ility st*ms *rom improp*r SQL i**nti*i*r quotin* in t** or**r k*y **n*lin* lo*i*. T** p*t** ***s `quot*I**nti*i*r()` **lls to *ll or**r k*y *ompon*nts, provin* t** ori*in*l *o** l**k** n***ss*ry s*nitiz*tion. T** *un*tion `pr*p*r*Listin**