SQL Injection in Pimcore Studio Backend Bundle

Detection Guidance

This vulnerability can be detected by testing the vulnerable endpoints for time-based blind SQL injection in the DateFilter column key parameter. Specifically, the POST /pimcore-studio/api/website-settings endpoint and other listing endpoints that accept a columnFilters array with a key field are susceptible.

To detect exploitation attempts or the vulnerability, you can send crafted POST requests to these endpoints with a columnFilters key containing a backtick character and SQL payloads such as SLEEP() to observe time delays indicating SQL injection.

Example command using curl to test for the vulnerability by injecting a time delay:

• curl -X POST https://your-pimcore-instance/pimcore-studio/api/website-settings -H 'Content-Type: application/json' -d '{"columnFilters":[{"key":"DateFilter` SLEEP(5)-- ","value":"2026-01-01"}]}'

If the response is delayed by approximately 5 seconds, it indicates the presence of the time-based blind SQL injection vulnerability.

Note that authenticated access is required to test this vulnerability, so ensure you have valid credentials.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated user to extract sensitive data from the database, including the admin password hash. This can lead to unauthorized access to administrative accounts if the password hashes are cracked.

Although the vulnerability does not directly affect data integrity or availability, it compromises confidentiality, potentially exposing sensitive information stored in the database.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Pimcore Studio Backend Bundle to version 2025.4.6 or later, or 2026.1.6 or later, where the issue is fixed.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Pimcore Studio Backend Bundle before versions 2025.4.6 and 2026.1.6. An authenticated user can exploit a time-based blind SQL injection in the DateFilter column key parameter. Specifically, the POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field is directly interpolated into SQL with manual backtick wrapping. Because the key field can include a backtick character, it can break out of the quoting and allow the attacker to append arbitrary SQL commands such as SLEEP() and IF() subqueries.

This flaw allows an attacker to extract sensitive information like the admin password hash and other database content by leveraging the SQL injection vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to extract the admin password hash and other database content through a time-based blind SQL injection. This exposure of sensitive authentication data could potentially lead to unauthorized access to administrative functions and sensitive information.

Such unauthorized access and data exposure may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and administrative data. However, the provided information does not explicitly detail the compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0