CVE-2023-30848: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2023-04-27T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Searchadmin/SearchController.php
Commit date: 2023-04-25 13:04:53 +0200
Commit message: Remove sql comments and add different exception on syntax error (#14972)


Diff: diff --git a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
index 5082616b5d63..651548b55ef6 100644
--- a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
+++ b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
@@ -13,10 +13,11 @@
  *  @license    http://www.pimcore.org/license     GPLv3 and PCL
  */
 
 namespace Pimcore\Bundle\AdminBundle\Controller\Searchadmin;
 
+use Doctrine\DBAL\Exception\SyntaxErrorException;
 use Pimcore\Bundle\AdminBundle\Controller\AdminController;
 use Pimcore\Bundle\AdminBundle\Controller\Traits\AdminStyleTrait;
 use Pimcore\Bundle\AdminBundle\Helper\GridHelperService;
 use Pimcore\Config;
 use Pimcore\Db\Helper;
@@ -109,10 +110,12 @@ class SearchController extends AdminController
         //For objects - handling of bricks
         $fields = [];
         $bricks = [];
         if (!empty($allParams['fields'])) {
             $fields = $allParams['fields'];
+            //remove sql comments
+            $fields = str_replace('--', '', $fields);
 
             foreach ($fields as $f) {
                 $parts = explode('~', $f);
                 if (substr($f, 0, 1) == '~') {
                     //                    $type = $parts[1];
@@ -308,11 +311,15 @@ class SearchController extends AdminController
             $eventDispatcher->dispatch($beforeListLoadEvent, AdminEvents::OBJECT_LIST_BEFORE_LIST_LOAD);
             /** @var Data\Listing $searcherList */
             $searcherList = $beforeListLoadEvent->getArgument('list');
         }
 
-        $hits = $searcherList->load();
+        try {
+            $hits = $searcherList->load();
+        } catch (SyntaxErrorException $syntaxErrorException) {
+            throw new \InvalidArgumentException('Check your arguments.');
+        }
 
         $elements = [];
         foreach ($hits as $hit) {
             $element = Element\Service::getElementById($hit->getId()->getType(), $hit->getId()->getId());
             if ($element->isAllowed('list')) {

Vulnerable code:         $hits = $searcherList->load();
Fixed code: use Doctrine\DBAL\Exception\SyntaxErrorException;
            //remove sql comments
            $fields = str_replace('--', '', $fields);
        try {
            $hits = $searcherList->load();
        } catch (SyntaxErrorException $syntaxErrorException) {
            throw new \InvalidArgumentException('Check your arguments.');
        }