medium6.5Public exploit code
CVE-2018-14058
Pimcore SQLi Vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery2018-08-16 · webapps · php
Impact
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | pimcore/pimcore | <= 5.2.3 | 5.3.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pimcore | Pimcore | before 5.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html
- http://seclists.org/fulldisclosure/2018/Aug/13
- https://www.exploit-db.com/exploits/45208/
- https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/
- https://github.com/advisories/GHSA-q4hw-c66h-4xqc
- https://nvd.nist.gov/vuln/detail/CVE-2018-14058