Sylius has a DQL Injection via API Order Filters

The Sylius eCommerce framework's API filters, specifically ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter, pass user-supplied order direction values directly to Doctrine's orderBy() method without any validation. This oversight enables an attacker to inject arbitrary DQL (Doctrine Query Language) by providing malicious order direction strings [1][2].

Exploitation is straightforward: an unauthenticated attacker sends a crafted HTTP GET request to the API endpoint, such as /api/v2/shop/products?order[price]=ASC,%20variant.code%20DESC. The injected DQL is appended to the query, allowing the attacker to manipulate the database query beyond intended parameters [2]. No special privileges are required; the vulnerable filters are part of the public API.

Successful DQL injection can lead to unauthorized data exposure or query manipulation. An attacker may be able to retrieve sensitive information from the database or alter the query logic to access data that should be restricted [1]. The impact is considered critical, as it compromises the confidentiality and integrity of the eCommerce platform's data.

The vulnerability has been patched in multiple Sylius versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3, and later. For those unable to update immediately, a workaround is available: implement an EventSubscriber that sanitizes order query parameters on API routes before they reach the vulnerable filters [2].