GHSA-q4hw-c66h-4xqc
Pimcore SQLi Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | pimcore/pimcore | < 5.3.0 | 5.3.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2018-14058
- https://www.exploit-db.com/exploits/45208
- https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software
- http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html
- http://seclists.org/fulldisclosure/2018/Aug/13