High severity · published Jan 24, 2024
CVE-2024-23646
Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
8.8
CVSS
1%
EPSS
No
On KEV
Description
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
admin-ui-classic-bundle · pimcore
>= 1.0.0, < 1.3.2 · source: vendor
AC
Admin Classic Bundle · Pimcore
1.0.0 before 1.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23646
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23646
Issue Tracking
https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006
Issue Tracking
https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087
Patch
https://github.com/pimcore/admin-ui-classic-bundle/commit/363afef29496cc40a8b863c2ca2338979fcf50a8
Release Notes
https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.3.2
Exploit
https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-cwx6-4wmf-c6xv
More from admin-ui-classic-bundle
9.3
CVE-2024-25625
Pimcore Host Header Injection in user invitation link
9.1
CVE-2024-24822
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
8.8
CVE-2024-23648
Pimcore Admin Classic Bundle host header injection in the password reset
7.2
CVE-2023-49075
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
6.5
CVE-2024-41109
Pimcore vulnerable to disclosure of system and database information behind /admin firewall