Executive brief
Pimcore's Custom Reports feature allows administrators to define custom SQL queries for data analysis. An authenticated admin user with report configuration permissions can inject arbitrary SQL commands through report configuration fields (sql, from, where, groupby), bypassing weak keyword-based filtering. This enables attackers to read, modify, or delete all data in the underlying database, resulting in complete compromise of all business data stored in the application.
Technical details
The vulnerability exists in the Sql adapter's buildQueryString() and getData() methods, where user-controlled configuration fields (sql, from, where, groupby) are directly concatenated into SQL queries without parameterization. The only protection is a regex blacklist checking for ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE keywords, which is trivially bypassable using INSERT, UNION SELECT, LOAD_FILE(), INTO OUTFILE, stacked queries, subqueries, or MySQL comment injection (/*!*/). Additionally, the LIMIT clause at line 51 directly interpolates $offset and $limit without integer casting, creating a secondary injection point. Exploitation requires authentication with reports_config permission and a valid admin session. An attacker can use UNION-based injection to extract arbitrary database tables (e.g., INFORMATION_SCHEMA) or execute INSERT/UPDATE/DELETE via unblocked SQL constructs. Patches are available in versions 2026.1.6, 12.3.10, and 11.5.19.
Affected products
- Pimcore pimcore >= 2026.1.0, <= 2026.1.5; >= 12.0.0-RC1, <= 12.3.9; < 11.5.18
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Patched versions 2026.1.6, 12.3.10, 11.5.19 released