CVE-2023-3820: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value:  SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2023-07-21T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Helper/GridHelperService.php
Commit date: 2023-07-13 12:50:59 +0200
Commit message: [Bug]: Quote sorting key (#15523)

* quote sorting key

* add quoting to order key with `?` case too

* refactor, no need to get Db

* break line to fix codesmell

* improve spacing

* remove trailing space
Diff: diff --git a/bundles/AdminBundle/Helper/GridHelperService.php b/bundles/AdminBundle/Helper/GridHelperService.php
index 9c04d1cbf7de..5d17ba02aebe 100644
--- a/bundles/AdminBundle/Helper/GridHelperService.php
+++ b/bundles/AdminBundle/Helper/GridHelperService.php
@@ -569,19 +569,20 @@ class GridHelperService
                     $orderKeyParts = explode('~', $orderKey);
 
                     if (strpos($orderKey, '?') !== false) {
                         $brickDescriptor = substr($orderKeyParts[0], 1);
                         $brickDescriptor = json_decode($brickDescriptor, true);
-                        $db = Db::get();
-                        $orderKey = $db->quoteIdentifier($brickDescriptor['containerKey'] . '_localized') . '.' . $db->quoteIdentifier($brickDescriptor['brickfield']);
+                        $orderKey = $list->quoteIdentifier($brickDescriptor['containerKey'] . '_localized')
+                            . '.' . $list->quoteIdentifier($brickDescriptor['brickfield']);
                         $doNotQuote = true;
                     } elseif (count($orderKeyParts) === 2) {
-                        $orderKey = $orderKeyParts[0].'.'.$orderKeyParts[1];
+                        $orderKey = $list->quoteIdentifier($orderKeyParts[0])
+                            . '.' . $list->quoteIdentifier($orderKeyParts[1]);
                         $doNotQuote = true;
                     }
                 } else {
-                    $orderKey = $list->getDao()->getTableName().'.'.$orderKey;
+                    $orderKey = $list->getDao()->getTableName() . '.' . $list->quoteIdentifier($orderKey);
                     $doNotQuote = true;
                 }
             }
         }
 

Vulnerable code:                         $db = Db::get();
                        $orderKey = $db->quoteIdentifier($brickDescriptor['containerKey'] . '_localized') . '.' . $db->quoteIdentifier($brickDescriptor['brickfield']);
                        $orderKey = $orderKeyParts[0].'.'.$orderKeyParts[1];
                    $orderKey = $list->getDao()->getTableName().'.'.$orderKey;
Fixed code:                         $orderKey = $list->quoteIdentifier($brickDescriptor['containerKey'] . '_localized')
                            . '.' . $list->quoteIdentifier($brickDescriptor['brickfield']);
                        $orderKey = $list->quoteIdentifier($orderKeyParts[0])
                            . '.' . $list->quoteIdentifier($orderKeyParts[1]);
                    $orderKey = $list->getDao()->getTableName() . '.' . $list->quoteIdentifier($orderKey);