SQL Injection

pimcore/pimcore is vulnerable to SQL injection. The vulnerability is due to improper sanitization of user-supplied SQL configuration in the columnConfigAction endpoint, which is concatenated into database queries, allowing an attacker with the reportsconfig permission to execute arbitrary SELECT ...