A vulnerability exists in Sylius versions through 1.9.11, 1.10.0 through 1.10.15, 1.11.0 through 1.11.16, 1.12.0 through 1.12.22, 1.13.0 through 1.13.14, 1.14.0 through 1.14.17, 2.0.0 through 2.0.15, 2.1.0 through 2.1.11, and 2.2.0 through 2.2.2. The issue arises in the Sylius API filters 'ProductPriceOrderFilter' and 'TranslationOrderNameAndLocaleFilter', which improperly handle user-supplied order direction values. These values are passed directly to Doctrine's 'orderBy()' method without any validation, allowing attackers to inject arbitrary Doctrine Query Language (DQL).
Exploitation of this vulnerability allows for DQL injection, where an attacker can manipulate the database query execution, potentially leading to unauthorized data access or modification.
To reproduce this vulnerability, send a GET request to the Sylius API endpoint for products, including the 'order' query parameter with unvalidated order direction values. For example, order by price in ascending order and variant code in descending order. The API will process the request without validating the order direction, allowing for DQL injection.
Users can update to Sylius versions 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, or 2.2.3. Alternatively, an 'EventSubscriber' can be created to sanitize 'order' query parameters on API routes before they reach the vulnerable filters.
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.
