Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2018/Aug/13 | Exploit Mailing List Third Party Advisory |
| https://www.exploit-db.com/exploits/45208/ | Exploit Third Party Advisory VDB Entry |
| https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/ | Exploit Third Party Advisory |
| http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2018/Aug/13 | Exploit Mailing List Third Party Advisory |
| https://www.exploit-db.com/exploits/45208/ | Exploit Third Party Advisory VDB Entry |
| https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 03:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2018/Aug/13 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/45208/ - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/ - Exploit, Third Party Advisory |
Information
Published : 2018-08-17 18:29
Updated : 2024-11-21 03:48
NVD link : CVE-2018-14058
Mitre link : CVE-2018-14058
CVE.ORG link : CVE-2018-14058
JSON object : View
Products Affected
pimcore
- pimcore
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')