https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:02:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338595 EUVD-2026-338595 https://cve.radiocsirt.org/vuln/euvd-2026-338595 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44739 <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.</p> <p>Pimcore is an Open Source Data &amp; Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44739 https://cve.radiocsirt.org/vuln/ghsa-3234-gxc3-pq6f <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>### Summary The columnConfigAction endpoint in the CustomReportsBundle is vulnerable to SQL injection. An attacker with the reports_config permission can supply a malicious SQL configuration that is concatenated into a query and executed. Although the application attempts to filter certain DDL/DML keywords (like UPDATE, DELETE, DROP), it fails to prevent arbitrary SELECT queries, UNION statements, or the use of dangerous database functions. Furthermore, because the application returns database error messages in the JSON response, an attacker can easily exfiltrate data using error-based SQL injection techniques. ### Affected scope bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php CustomReportController:columnConfigAction -&gt; SqlAdapter::getColumns -&gt; SqlAdapter::buildQueryString -&gt; Db::fetchAssociative()</p> <p>### PoC * Download and install the version Pimcore &lt;=12.3.3 (latest) * Login using Admin account or any account that has reports_config permission * Navigate to custom reports * Capture the request using burp suite and perform SQLi attack as the following 1. Get Database username ``` POST /admin/bundle/customreports/custom-report/column-config HTTP/1.1 Host: localhost Content-Length: 310 sec-ch-ua-platform: &#34;Linux&#34; Accept-Language: en-US,en;q=0.9 sec-ch-ua: &#34;Not_A Brand&#34;;v=&#34;99&#34;, &#34;Chromium&#34;;v=&#34;142&#34; sec-ch-ua-mobile: ?0 X-pimcore-extjs-version-minor: 0 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (…</p> <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>### Summary The columnConfigAction endpoint in the CustomReportsBundle is vulnerable to SQL injection. An attacker with the reports_config permission can supply a malicious SQL configuration that is concatenated into a query and executed. Although the application attempts to filter certain DDL/DML keywords (like UPDATE, DELETE, DROP), it fails to prevent arbitrary SELECT queries, UNION statements, or the use of dangerous database functions. Furthermore, because the application returns database error messages in the JSON response, an attacker can easily exfiltrate data using error-based SQL injection techniques. ### Affected scope bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php CustomReportController:columnConfigAction -&gt; SqlAdapter::getColumns -&gt; SqlAdapter::buildQueryString -&gt; Db::fetchAssociative()</p> <p>### PoC * Download and install the version Pimcore &lt;=12.3.3 (latest) * Login using Admin account or any account that has reports_config permission * Navigate to custom reports * Capture the request using burp suite and perform SQLi attack as the following 1. Get Database username ``` POST /admin/bundle/customreports/custom-report/column-config HTTP/1.1 Host: localhost Content-Length: 310 sec-ch-ua-platform: &#34;Linux&#34; Accept-Language: en-US,en;q=0.9 sec-ch-ua: &#34;Not_A Brand&#34;;v=&#34;99&#34;, &#34;Chromium&#34;;v=&#34;142&#34; sec-ch-ua-mobile: ?0 X-pimcore-extjs-version-minor: 0 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (…</p> https://cve.radiocsirt.org/vuln/ghsa-3234-gxc3-pq6f