CVE-2026-23492
📋 TL;DR
This CVE describes a blind SQL injection vulnerability in Pimcore's Admin Search Find API that affects authenticated users. Attackers can infer database information through blind injection techniques despite previous mitigation attempts. This vulnerability impacts Pimcore installations with admin interface access and can lead to database information disclosure.
💻 Affected Systems
- Pimcore
📦 What is this software?
Pimcore by Pimcore
Pimcore by Pimcore
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive user data, configuration secrets, and potential lateral movement to other systems
Likely Case
Database information disclosure including user credentials, configuration data, and business information
If Mitigated
Limited impact with proper input validation and database permission restrictions
🎯 Exploit Status
Exploitation requires authenticated admin access and knowledge of blind SQL injection techniques
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.3.1 or 11.5.14
Vendor Advisory: https://github.com/pimcore/pimcore/security/advisories/GHSA-qvr7-7g55-69xj
Restart Required: Yes
Instructions:
1. Backup your Pimcore installation and database. 2. Update to version 12.3.1 (for v12) or 11.5.14 (for v11). 3. Restart the application server. 4. Verify the fix by testing the Admin Search Find API.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for Admin Search API parameters
Modify application code to validate and sanitize all user inputs in search functionality
Database Permission Restriction
allRestrict database user permissions to minimum required
ALTER USER 'pimcore_user'@'localhost' WITH GRANT OPTION;
REVOKE ALL PRIVILEGES ON *.* FROM 'pimcore_user'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON pimcore_db.* TO 'pimcore_user'@'localhost';
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict admin interface access to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check Pimcore version via admin interface or by examining version filesCheck Version:
php bin/console pimcore:versionVerify Fix Applied:
Test Admin Search Find API with SQL injection payloads that don't use comments📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by search API requests
- Long or unusual parameter values in search requests
Network Indicators:
- Repeated POST requests to /admin/search/find with varying parameters
- Unusual timing patterns in API responses
SIEM Query:
source="web_logs" AND uri="/admin/search/find" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*" OR param="*AND*")