Listen to this Post
The vulnerability exists in the `/admin/search/search/find` API endpoint. The patch for CVE-2023-30848 attempted to fix SQL injection by filtering `–` SQL comments and catching SyntaxErrorException. However, this mitigation is incomplete. The `fields[]` parameter remains user-controlled and is used unsafely in SQL query construction. Attackers can bypass the comment filter by using payloads that don’t require comments, such as boolean-based or time-based techniques. The exception handling only suppresses error messages but does not prevent query execution. This allows an authenticated attacker to inject malicious SQL logic into the query. By crafting conditional statements like `CASE WHEN` or using functions like SLEEP(), they can infer database information through response delays or boolean differences, leading to full blind SQL injection and potential data disclosure.
Platform: Pimcore
Version: Not specified
Vulnerability : Blind SQL Injection
Severity: Critical
date: 2023
Prediction: Patch date unknown
What Undercode Say:
Analytics:
curl -g "http://target/admin/search/search/find?query=2&fields[]=field1 AND IF(1=1,SLEEP(5),0)~field2&filter=[{\"property\":\"value\"}]&class=classname"
// Incomplete patch code:
$fields = str_replace('--', '', $fields);
try {
$hits = $searcherList->load();
} catch (SyntaxErrorException $e) {
throw new \InvalidArgumentException('Check your arguments.');
}
How Exploit:
1. Authenticate to admin.
2. Craft Boolean/time-based payload.
3. Inject via `fields[]` parameter.
4. Observe response/timing differences.
5. Extract data iteratively.
Protection from this CVE
Apply comprehensive patch.
Use parameterized queries.
Implement input validation.
Restrict admin access.
Impact:
Authenticated attack required.
Database information disclosure.
Potential full compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
