Pimcore SQL Injection Vulnerability in Relation Filter Condition Parsing

A SQL injection vulnerability has been identified in Pimcore versions prior to 11.5.4. This issue allows authenticated users to manipulate filter strings, leading to unescaped input being executed in SQL queries. The vulnerability arises in the 'getRelationFilterCondition' method of the 'RelationFilterConditionParser' trait, which is used by the 'Multiselect' data field type.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, an authenticated user can create a filter string for a relation field that includes unescaped SQL payloads. The 'getRelationFilterCondition' method will process this input without proper sanitization, allowing the crafted SQL to be executed.

Remediation

Users should upgrade to Pimcore version 11.5.4 or later, where this vulnerability has been patched.