Executive brief
Pimcore Admin Classic Bundle is a management interface for the Pimcore data platform. A security vulnerability in the translation management component allows an authenticated user to perform unauthorized database queries. This could lead to the theft of sensitive information, such as user credentials, or potentially allow an attacker to take full control of the server when combined with other known issues.
Technical details
A SQL injection vulnerability exists in the `TranslationController.php` component of the Pimcore Admin Classic Bundle. The vulnerability occurs because the `property` field from user-supplied JSON filter parameters is directly interpolated into a SQL expression within the `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` function. While the application attempts to sanitize the input by removing '--' strings, this protection is easily bypassed using alternative SQL comment syntax. An authenticated attacker with permissions to view translations can exploit this via a POST request to `/admin/translation/translations` to perform UNION-based or error-based SQL injection. This can be further chained with other vulnerabilities (like unsafe deserialization) to achieve Remote Code Execution (RCE). The issue is fixed in version 2.3.6 by implementing an allowlist for valid column names and using identifier quoting.
Affected products
- Pimcore admin-ui-classic-bundle <= 2.3.5
Timeline
- 2026-05-26: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched