Pimcore Admin Ui Classic Bundle
Monthly
SQL injection in Pimcore admin-ui-classic-bundle (all versions through 2.3) permits authenticated backend users to execute arbitrary SQL against the underlying database via the DataObject grid id column filter. The filter value is concatenated unsanitized directly into a SQL WHERE clause, bypassing parameterization entirely, enabling an attacker to exfiltrate or modify all database contents. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS score of 8.8 with full C/I/A:H impact and the straightforward CWE-89 pattern make this a meaningful risk for any unpatched Pimcore deployment.
SQL injection in Pimcore admin-ui-classic-bundle (all versions through 2.3) permits authenticated backend users to execute arbitrary SQL against the underlying database via the DataObject grid id column filter. The filter value is concatenated unsanitized directly into a SQL WHERE clause, bypassing parameterization entirely, enabling an attacker to exfiltrate or modify all database contents. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS score of 8.8 with full C/I/A:H impact and the straightforward CWE-89 pattern make this a meaningful risk for any unpatched Pimcore deployment.