{"id":"CVE-2018-14058","published":"2018-08-17T18:00:00Z","modified":"2024-08-05T09:21:40Z","title":"Pimcore before 5.3.0 allows SQL Injection via the REST web service API","vendor":null,"product":null,"tier":"tail","description":{"text":"Pimcore before 5.3.0 allows SQL Injection via the REST web service API.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.28623,"percentile":0.9813,"provenance":"source"},"cwes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Aug/13","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html","tags":["x_refsource_MISC"]},{"url":"https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/45208/","tags":["exploit","x_refsource_EXPLOIT-DB"]}],"priority":{"score":24.6,"factors":[{"name":"EPSS percentile","points":19.63},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":3,"earliest":"2018-08-16"},"metasploit":[{"name":"Pimcore Gather Credentials via SQL Injection","module":"auxiliary/gather/pimcore_creds_sqli","type":"auxiliary","disclosureDate":"2018-08-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/pimcore_creds_sqli.rb"}],"first":{"date":"2018-08-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/pimcore_creds_sqli.rb"},"provenance":"source"},"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<5.3.0"],"patched":["5.3.0"],"from":["GHSA-q4hw-c66h-4xqc"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4879","exploited":false,"provenance":"source"},"exploits":[{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"},{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"},{"id":45208,"url":"https://www.exploit-db.com/exploits/45208","title":"Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery","date":"2018-08-16","verified":false,"provenance":"source"}],"exploitRefs":["https://www.exploit-db.com/exploits/45208/","http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html","https://www.exploit-db.com/exploits/45208"]}