Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2023-30848: Pimcore admin search can be tricked to run database commands
CVE-2023-30848 · published 3 years ago
Summary
The admin search feature in Pimcore versions before 10.5.21 can be manipulated to execute unwanted database queries, which could allow an attacker to view or change data. Update Pimcore to version 10.5.21 as soon as possible, or apply the provided manual patch if you cannot upgrade immediately.
What to do
- Update pimcore pimcore to version 10.5.21.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | pimcore | pimcore |
< 10.5.21 Fix: upgrade to 10.5.21
|
Original advisory text
Pimcore SQL Injection Vulnerability in Admin Search Find API
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
References
- https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35c...
- https://github.com/advisories/GHSA-6mhm-gcpf-5gr8
- https://github.com/pimcore/pimcore/security/advisories/GHSA-6mhm-gcpf-5gr8 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-30848 Vendor Advisory
- https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35c... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30848... Vendor Advisory
- https://github.com/pimcore/pimcore/pull/14972 Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published27 Apr 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta