SQL Injection

pimcore/pimcore is vulnerable to sql injection. The vulnerability exists due to improper quoting of columns in setOrderKey function and setGroupBy function of AbstractListing.php when using setOrderBy or setGroupBy on listing classes...

GHSA-GVMF-WCX6-P974 Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore

Impact Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the...

Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore

Impact Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the...

PT-2022-20520

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.4.4 Description Pimcore is an Open Source Data & Experience Management Platform that offers developers listing classes to make querying data easier. These listing classes allow ordering or grouping results based on...