EUVD-2021-18742

Malware in sbrugna...

SQL injection in SegmentAssignmentController.php

Description An administrator user can use the inheritableSegments feature to execute his own blind SQL queries. Proof of Concept The vulnerable php code is in src/Controller/Admin/SegmentAssignmentController.php, on method inheritableSegments: The parameter type is not escaped and is added on the...

The vulnerability of the SegmentAssignmentController.php component of the data management and customer interaction software in the Pimcore Customer Data Framework allows a malicious actor to disclose protected information.

The vulnerability of the SegmentAssignmentController.php component of the data management and customer interaction software in the Pimcore Customer Data Framework is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to...