SQL Injection

pimcore is vulnerable to SQL injection. An attacker is able to inject and execute arbitrary SQL statements on the database via the data classification functionality in ClassificationstoreController, due to inadequate validation of relationIds parameter...

CVE-2020-7759

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request:...

PT-2020-19772

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions 6.7.2 through 6.8.3 Description The issue affects the data classification functionality in ClassificationstoreController, allowing for SQL Injection. This can be exploited by sending a specifically-crafted input in the...

CVE-2020-7759: Improper Neutralization of Special Elements used in an SQL Command

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request:...