TI-2024-15665 Aliases CVE-2024-23646 GHSA-cwx6-4wmf-c6xv

Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

HIGH 73CWE-89Published 2024-01-24 · Updated 2025-05-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL Injection. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. Version 1.3.2 contains a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00997 62nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed admin-ui-classic-bundle (pimcore): 1.3.2pimcore/admin-ui-classic-bundle (Packagist): 1.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pimcore	admin-ui-classic-bundle	1.0.0 to before 1.3.2	1.3.2	Patch available	CNA
—	pimcore/admin-ui-classic-bundle (Packagist)	1.0.0 to before 1.3.2	1.3.2	Patch available	GHSA-cwx6-4wmf-c6xv

admin-ui-classic-bundle Vendorpimcore Affected 1.0.0 to before 1.3.2 Fixed in 1.3.2 Patch available CNA
pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected 1.0.0 to before 1.3.2 Fixed in 1.3.2 Patch available GHSA-cwx6-4wmf-c6xv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pimcore:admin_classic_bundle::::::pimcore::*	1.0.0 to before 1.3.2	Vulnerable	pimcore

cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:* Versions 1.0.0 to before 1.3.2 Vulnerable ·pimcore

Remediation

Fix · CNA admin-ui-classic-bundle (pimcore) Fixed in 1.3.2
Fix · GHSA-cwx6-4wmf-c6xv pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.3.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-23646
2026-10-03 Alias added: GHSA-cwx6-4wmf-c6xv

References

Other 4

TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
TI-2025-18658 Pimcore Admin Classic Bundle allows user enumeration CVSS 4.0MEDIUM 6.9
TI-2023-05380 Unverified Password Change in pimcore/admin-ui-classic-bundle CVSS 3.1HIGH 7.2
TI-2023-25777 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVSS 3.1MEDIUM 5.3
TI-2024-27461 Pimcore vulnerable to disclosure of system and database information behind /admin firewall CVSS 3.1MEDIUM 6.5

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences