Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

CVE-2023-38221 is an SQL injection vulnerability in Adobe Commerce affecting versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier, and 2.4.4-p5 and earlier. The issue arises from improper neutralization of special elements used in SQL commands, enabling an attacker to inject malicious SQL code into database queries [1].

Exploitation requires an attacker with administrative privileges and is considered of high complexity, as it demands knowledge of tooling beyond the standard user interface. No user interaction is necessary for the attack [1].

Successful exploitation could lead to arbitrary code execution on the underlying server, potentially compromising the entire e-commerce platform and its data [1].

Administrators of affected systems should apply the latest security updates provided by Adobe. No workarounds have been published, and the vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities catalog [1].