CVE-2024-23646: Pimcore Admin Classic Bundle SQLi Flaw

CVE-2024-23646 Overview

CVE-2024-23646 is a SQL Injection vulnerability [CWE-89] in the Pimcore Admin Classic Bundle, which provides the backend user interface for Pimcore. The flaw resides in the downloadAsZipAddFilesAction method of AssetController.php, where the selectedIds parameter is concatenated directly into a SQL query without proper quoting. Any authenticated backend user with basic permissions can inject arbitrary SQL statements. Successful exploitation allows attackers to read or modify database contents and escalate privileges to administrator. The issue affects the 1.x branch prior to version 1.3.2.

Critical Impact
A low-privileged backend user can execute arbitrary SQL, tamper with any data, and escalate to admin-level access.

Affected Products

Pimcore Admin Classic Bundle 1.x branch prior to 1.3.2
pimcore/admin-ui-classic-bundle package installations
Pimcore deployments exposing the admin backend to authenticated users

Discovery Timeline

2024-01-24 - CVE-2024-23646 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23646

Vulnerability Analysis

The vulnerability exists in the asset download-as-zip functionality of the Admin Classic Bundle. When a backend user initiates a zip download of selected assets, the controller builds a raw SQL query that embeds user-supplied identifiers from selectedIds directly into the statement. Because the identifiers are neither parameterized nor quoted, malicious SQL fragments break out of the intended query context. The affected code paths are located at lines 2006 and 2087 of src/Controller/Admin/Asset/AssetController.php.

Any backend user with minimal permissions is authorized to call the endpoint. This lowers the barrier for exploitation to anyone with a valid admin login. Attackers can extract sensitive data, modify records, add administrative users, or manipulate access-control tables to escalate privileges.

Root Cause

The root cause is improper neutralization of SQL syntax in the downloadAsZipAddFilesAction method. The selectedIds values were interpolated into the query using implode(',', $userIds) without validation, quoting, or prepared statements. The fix in commit 363afef adds proper quoting around the identifiers processed in the download-as-zip logic.

Attack Vector

Exploitation requires network access to the Pimcore admin interface and a valid low-privileged backend account. The attacker submits a crafted request to the asset download endpoint with a manipulated selectedIds parameter containing SQL payloads. The injected SQL executes with the database privileges of the Pimcore application user, granting broad read and write access.

php

// Security patch in src/Controller/Admin/Asset/AssetController.php
// fix: add quote for ids processed in downloadAsZipAddFilesAction method (#405)
                 $userIds = $this->getAdminUser()->getRoles();
                 $userIds[] = $this->getAdminUser()->getId();
                 $conditionFilters[] = ' (
-                                                    (select list from users_workspaces_asset where userId in (' . implode(',', $userIds) . ') and LOCATE(CONCAT(`path`, filename),cpath)=1  ORDER BY LENGTH(cpath) DESC LIMIT 1)=1
-                                                    OR
-                                                    (select list from users_workspaces_asset where userId in (' . implode(',', $userIds) . ') and LOCATE(cpath,CONCAT(`path`, filename))=1  ORDER BY LENGTH(cpath) DESC LIMIT 1)=1
-                                                 )';
+                   (select list from users_workspaces_asset where userId in (' . implode(',', $userIds) . ') and LOCATE(CONCAT(`path`, filename),cpath)=1  ORDER BY LENGTH(cpath) DESC LIMIT 1)=1
+                   OR
+                   (select list from users_workspaces_asset where userId in (' . implode(',', $userIds) . ') and LOCATE(cpath,CONCAT(`path`, filename))=1  ORDER BY LENGTH(cpath) DESC LIMIT 1)=1
+                )';
             }

             $condition = implode(' AND ', $conditionFilters);
// Source: https://github.com/pimcore/admin-ui-classic-bundle/commit/363afef29496cc40a8b863c2ca2338979fcf50a8

Detection Methods for CVE-2024-23646

Indicators of Compromise

Unexpected HTTP requests to the asset download-as-zip endpoint containing SQL keywords such as UNION, SELECT, SLEEP, or -- in the selectedIds parameter.
New administrative accounts, unexpected role assignments, or changes in the users and users_workspaces_asset tables.
Application error logs referencing malformed SQL queries originating from AssetController.php.

Detection Strategies

Inspect webserver and application logs for requests to the Pimcore admin asset controller with unusual selectedIds values or excessive parameter lengths.
Enable and review database query logs for anomalous statements executed from the Pimcore application user, particularly against users_workspaces_asset.
Correlate authenticated backend sessions with sudden privilege changes or bulk data queries.

Monitoring Recommendations

Alert on any backend user account whose role or permission set changes outside of a documented administrative workflow.
Monitor for repeated 500 responses or database syntax errors returned from the admin bundle endpoints.
Track outbound data volumes from the Pimcore application server for signs of database exfiltration.

How to Mitigate CVE-2024-23646

Immediate Actions Required

Upgrade pimcore/admin-ui-classic-bundle to version 1.3.2 or later, which contains the fix from commit 363afef.
Audit all backend user accounts and revoke access for accounts that are inactive or unnecessary.
Review database records for unauthorized modifications, focusing on user, role, and workspace tables.

Patch Information

The fix is available in the GitHub Release v1.3.2. Technical details are documented in the GitHub Security Advisory GHSA-cwx6-4wmf-c6xv and the remediation commit 363afef.

Workarounds

Restrict network access to the Pimcore admin interface using IP allow-lists, VPN, or a reverse proxy with authentication controls.
Apply a web application firewall rule that inspects the selectedIds parameter on asset download endpoints and blocks SQL metacharacters.
Temporarily disable the asset zip-download feature for non-administrative roles until the patch is applied.

bash

# Update the Pimcore Admin Classic Bundle via Composer to a patched release
composer require pimcore/admin-ui-classic-bundle:^1.3.2
composer update pimcore/admin-ui-classic-bundle
bin/console cache:clear --env=prod