VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Mar 22, 2023· Updated Feb 25, 2025

Pimcore vulnerable to improper quoting of filters in Custom Reports

CVE-2023-28438

Description

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pimcore/pimcorePackagist
< 10.5.1910.5.19

Affected products

1

Patches

1
d1abadb181c8

[Task] Optimized custom reports filter (#14526)

https://github.com/pimcore/pimcoreChristian FMar 6, 2023via ghsa
commit
1 file changed · +3 −2
  • models/Tool/CustomReport/Adapter/Sql.php+3 −2 modified
    @@ -38,7 +38,8 @@ public function getData($filters, $sort, $dir, $offset, $limit, $fields = null,
 
             $order = '';
             if ($sort && $dir) {
-                $order = ' ORDER BY ' . $db->quoteIdentifier($sort) . ' ' . $dir;
+                $dir = ((strtoupper($dir) === 'ASC') ? 'ASC' : 'DESC');
+                $order = ' ORDER BY ' . $db->quoteIdentifier($sort) . ' ' .$dir;
             }
 
             $sql = $baseQuery['data'] . $order;
@@ -125,7 +126,7 @@ protected function buildQueryString($config, $ignoreSelectAndGroupBy = false, $d
             $db = Db::get();
             foreach ($drillDownFilters as $field => $value) {
                 if ($value !== '' && $value !== null) {
-                    $havingParts[] = "$field = " . $db->quote($value);
+                    $havingParts[] = ($db->quoteIdentifier($field) ." = " . $db->quote($value));
                 }
             }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.