SQL Injection

pimcore/pimcore is vulnerable to sql injection. An attacker can inject and execute malicious input through thegetFilterCondition function of GridHelperService.php as the library does not properly filter the user input request parameters...

SQL Injection found in Pimcore

Pimcore is an open source data & experience management platform. A SQL injection was discovered in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6...

SQL injection in GridHelperService.php

Description In line 786, we can see $conditionFilters = $filterField . ' ' . $operator . ' ' . $value;. The three variables joins to a string, and the variables come from the request parameter.Maybe line 793 is vulnerable too. The code comes from prepareAssetListingForGrid function. The function ...