CVE-2024-11956 Overview
CVE-2024-11956 is a SQL injection vulnerability in the Pimcore customer-data-framework up to version 4.2.0. The flaw resides in the /admin/customermanagementframework/customers/list endpoint. Attackers can manipulate the filterDefinition/filter argument to inject arbitrary SQL statements into backend database queries. The vulnerability is remotely exploitable and requires authenticated access with high privileges. Pimcore addressed the issue in version 4.2.1.
Critical Impact
Authenticated remote attackers can inject SQL statements through the customer list filter, exposing customer data and potentially altering database contents.
Affected Products
- Pimcore customer-data-framework versions up to and including 4.2.0
- Pimcore platform installations bundling the vulnerable framework
- Fixed in Pimcore customer-data-framework version 4.2.1
Discovery Timeline
- 2025-01-28 - CVE-2024-11956 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11956
Vulnerability Analysis
The vulnerability is a SQL injection issue [CWE-89] within the Pimcore Customer Data Framework administrative interface. The /admin/customermanagementframework/customers/list route accepts a filterDefinition structure containing a filter argument. That argument is concatenated into a database query without proper parameterization or sanitization.
An attacker with authenticated administrative access to the customer management console can supply crafted filter expressions. These expressions break out of the intended query context and execute attacker-controlled SQL. The result is unauthorized read and write access to backend tables managed by the framework.
The issue also falls under CWE-74 (Improper Neutralization of Special Elements in Output). It affects confidentiality, integrity, and availability of the customer database in a limited fashion, as reflected in the CVSS 4.0 vector scoring.
Root Cause
The root cause is the direct incorporation of user-supplied filter input into a SQL statement. The filterDefinition/filter parameter is not bound as a parameterized query value. Instead the framework interprets the filter fragment as query syntax, allowing SQL keywords, operators, and subqueries submitted by the caller to reach the database driver unchanged.
Attack Vector
Exploitation occurs over the network against the Pimcore administration interface. The attacker must already possess high-privileged credentials to reach the /admin/customermanagementframework/customers/list handler. Once authenticated, the attacker submits a POST or GET request containing a manipulated filterDefinition[filter] payload. The injected SQL clauses execute in the context of the Pimcore database user.
Exploit details have been disclosed publicly, and ExploitDB references exist for this issue. See the Pimcore Security Advisory GHSA-q53r-9hh9-w277 for maintainer confirmation.
No verified proof-of-concept code is reproduced here. Refer to the VulDB entry #293906 for technical write-ups.
Detection Methods for CVE-2024-11956
Indicators of Compromise
- Requests to /admin/customermanagementframework/customers/list containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA inside the filterDefinition or filter parameter.
- Unexpected long-running database queries originating from the Pimcore application user.
- Administrative session activity from IP addresses or user agents that do not match the operations team baseline.
Detection Strategies
- Enable database query logging and alert on queries against customer tables that contain unusual constructs such as stacked queries, boolean tautologies, or time-based delays.
- Deploy a web application firewall (WAF) rule set targeting SQL injection patterns on the /admin/customermanagementframework/* path.
- Correlate authenticated admin sessions with query anomalies to identify credential misuse against the customer framework.
Monitoring Recommendations
- Monitor Pimcore application logs for HTTP 500 responses on the customer list endpoint, which often accompany injection attempts.
- Track privileged account logins to the Pimcore admin console and flag off-hours or geographically anomalous access.
- Review MySQL or MariaDB general_log and slow_query_log for suspicious statements referencing plugin_cmf_customers or related tables.
How to Mitigate CVE-2024-11956
Immediate Actions Required
- Upgrade the Pimcore customer-data-framework to version 4.2.1 or later immediately.
- Rotate credentials for administrative accounts with access to the customer management module.
- Audit database logs and customer records for signs of prior injection activity.
- Restrict network access to the Pimcore admin interface to trusted management networks or VPN only.
Patch Information
Pimcore released the fix in customer-data-framework version 4.2.1. Details are published in the GitHub Release v4.2.1 notes and the GHSA-q53r-9hh9-w277 advisory. Update through Composer using the standard Pimcore dependency upgrade workflow, then clear the application cache and verify functionality of the customer list view.
Workarounds
- If immediate patching is not possible, remove or disable the customer management framework bundle until the update can be applied.
- Apply WAF signatures that block SQL metacharacters on the filterDefinition and filter request parameters.
- Enforce least privilege on the database account used by Pimcore, revoking write access to tables that do not require it.
# Configuration example
composer require pimcore/customer-data-framework:^4.2.1
bin/console cache:clear --env=prod
bin/console pimcore:migrations:migrate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
