8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23492

CVE-2026-23492: Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure. This vulnerability is fixed in 12.3.1 and 11.5.14.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23492

CVE-2026-23492:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pimcore/pimcore	composer	>= 12.0.0-RC1, < 12.3.1	12.3.1
pimcore/pimcore	composer	<= 11.5.13	11.5.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided vulnerability description and the associated commit 25ad8674886f2b938243cbe13e33e204a2e35cc3 confirms that the vulnerability lies within the findAction method of the Pimcore\Bundle\AdminBundle\Controller\Searchadmin\SearchController class. The vulnerability is a result of an incomplete patch for a previous SQL injection flaw (CVE-2023-30848). The patch only filters out -- style comments and suppresses database error messages, but fails to properly sanitize the user-provided fields[] parameter. This parameter is directly used in building an SQL query, which is executed when $searcherList->load() is called. The proof-of-concept demonstrates that blind SQL injection is possible by injecting malicious SQL expressions into the fields[] parameter, confirming that findAction is the entry point for the vulnerability. Therefore, this function would appear in a runtime profile when the vulnerability is exploited.

Vulnerable functions

Pimcore\Bundle\AdminBundle\Controller\Searchadmin\SearchController::findAction

bundles/AdminBundle/Controller/Searchadmin/SearchController.php

The `findAction` function processes the user-controlled `fields[]` parameter from the HTTP request. The patch applied in commit 25ad8674886f2b938243cbe13e33e204a2e35cc3 attempts to mitigate an SQL injection vulnerability by removing SQL comments (`--`) and catching `SyntaxErrorException`. However, this fix is incomplete. The function still allows other forms of SQL payloads (e.g., boolean-based or time-based) to be passed in the `$fields` variable, which is then used in the `$searcherList->load()` method to construct and execute an SQL query. This allows an authenticated attacker to perform blind SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.