Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.7
CVE-2023-1578: Pimcore allows attackers to run unauthorized database commands
CVE-2023-1578 · published 3 years ago
Summary
Versions of Pimcore before 10.5.19 can be tricked into executing harmful database queries, potentially exposing or altering your data. This happens when input is not properly checked before being used in the database. Upgrade Pimcore to version 10.5.19 or newer to resolve the issue.
What to do
- Update pimcore pimcore to version 10.5.19.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | pimcore | pimcore |
< 10.5.19 Fix: upgrade to 10.5.19
|
Original advisory text
SQL Injection in pimcore/pimcore
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-42c3-wvww-gcqj
- https://github.com/pimcore/pimcore/pull/14538
- https://nvd.nist.gov/vuln/detail/CVE-2023-1578 Vendor Advisory
- https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e/
- https://github.com/advisories/GHSA-42c3-wvww-gcqj
- https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e URL
- https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1578.j... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.7
Medium
Type
CWE-89SQL Injection
Timeline
Published22 Mar 2023
Updated20 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta