Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a two-stage SQL injection. The first stage occurs in Pimcore\Model\DataObject\ClassDefinition::saveClassInternal, where insufficient input validation on the class definition ID allows a malicious SQL payload to be saved. The regex used for validation was missing a trailing $ anchor, meaning it only checked if the ID started with a valid pattern, not that the entire string was valid. The second stage is triggered in Pimcore\Model\DataObject\ClassDefinition\Data\Block::load. When loading data for an object, this function constructs a table name by concatenating 'object_store_' with the unquoted, unsanitized class ID. This executes the SQL payload that was injected during the class creation step, leading to data exfiltration.
Pimcore\Model\DataObject\ClassDefinition::saveClassInternalmodels/DataObject/ClassDefinition.php
Pimcore\Model\DataObject\ClassDefinition\Data\Block::loadmodels/DataObject/ClassDefinition/Data/Block.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | >= 2026.1.0, <= 2026.1.4 | 2026.1.5 |
| pimcore/pimcore | composer | < 12.3.9 | 12.3.9 |