7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-c8g3-x47w-8q7p

GHSA-c8g3-x47w-8q7p: Duplicate Advisory: Pimcore admin users can trigger SQL Injection

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r2f4-ff2p-xc64. This link is maintained to preserve external references.

Original Description

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.

This issue affects pimcore: 12.3.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-c8g3-x47w-8q7p

GHSA-c8g3-x47w-8q7p:

7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pimcore/pimcore	composer	= 12.3.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in Pimcore's DataObject class definition functionality. The analysis of the provided patch in pull request #19108 reveals the root cause. An authenticated administrative user can define composite indices for DataObjects. The vulnerability stems from two key functions: Pimcore\Model\DataObject\ClassDefinition::setCompositeIndices and Pimcore\Model\DataObject\Traits\CompositeIndexTrait::updateCompositeIndices.

First, setCompositeIndices receives the index definitions, including index keys and column names, from the user. Before the patch, this function did not perform any validation or sanitization on these inputs.

Second, the unsanitized data is passed to updateCompositeIndices, which is responsible for creating and dropping database indices. This function constructed ALTER TABLE queries by directly concatenating the unvalidated index key and column names into the SQL statements. This allowed an attacker to inject arbitrary SQL commands by crafting a malicious index definition.

The patch addresses this vulnerability at two levels. It introduces a new assertValidIdentifier function to strictly validate the format of index keys and column names within both setCompositeIndices and updateCompositeIndices. Additionally, it modifies updateCompositeIndices to use the database's quoteIdentifier method, which properly escapes identifiers to prevent injection, thus neutralizing the threat. The vulnerable functions are the ones that previously handled the user input without proper validation and constructed the insecure SQL queries.

Vulnerable functions

Pimcore\Model\DataObject\ClassDefinition::setCompositeIndices

models/DataObject/ClassDefinition.php

This function processes user-provided composite index definitions. Before the patch, it did not validate the 'index_key' or 'index_columns' values. This allowed an attacker to inject malicious strings that would later be used in raw SQL queries in the `updateCompositeIndices` function, leading to SQL injection. The patch adds calls to `assertValidIdentifier` to sanitize the input.

Pimcore\Model\DataObject\Traits\CompositeIndexTrait::updateCompositeIndices

models/DataObject/Traits/CompositeIndexTrait.php

This function constructs and executes `ALTER TABLE` SQL queries to create or drop composite indices. Prior to the patch, it built these queries by directly concatenating user-controllable values (index keys and column names) into the SQL string. This is a classic SQL injection vulnerability. The patch mitigates this by using `quoteIdentifier` for all parts of the query that come from user input, ensuring they are properly escaped.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.