Vulnerability: Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore ### Impact
Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. 
The actual issue is that quoting is not done properly in both cases, so there's the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and  so relies on the auto-quoting being done by the listing classes. 

##### Example: 
```php
// request url: https://example.com/foo?groupBy=o_id`; SELECT SLEEP(20);--

$list = new DataObject\Car\Listing();
$list->setOrderKey($request->get('orderBy'));
$list->setGroupBy($request->get('groupBy'));
$list->load();
```

### Patches
Upgrade to >= 10.4.4 or apply the following patch manually: 
https://github.com/pimcore/pimcore/commit/21559c6bf0e4e828d33ff7af6e88caecb5ac6549.patch

### Workarounds
Apply this patch manually: 
https://github.com/pimcore/pimcore/commit/21559c6bf0e4e828d33ff7af6e88caecb5ac6549.patch

### References
https://github.com/pimcore/pimcore/pull/12444
Vulnerability ID: GHSA-gvmf-wcx6-p974
CWE: CWE-89
Severity score: 8.1
Project: https://github.com/pimcore/pimcore
Published: 2022-06-22
File: lib/Model/Listing/AbstractListing.php
Commit message: [Security] SQL Injection in Data Hub GraphQL (#12444)

* [Security] SQL Injection in Data Hub GraphQL (AbstractListing)

* Update lib/Model/Listing/AbstractListing.php

Co-authored-by: Jacob Dreesen <j.dreesen@neusta.de>

* Update lib/Model/Listing/AbstractListing.php

Co-authored-by: mcop1 <89011527+mcop1@users.noreply.github.com>

Co-authored-by: Jacob Dreesen <j.dreesen@neusta.de>
Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>
Commit author: mcop1

Vulnerable version (before fix):
 public function setOrderKey($orderKey, $quote = true)                 if ($quote === false) {                     $this->orderKey[] = $o;                 } elseif ($this->isValidOrderKey($o)) {                     $this->orderKey[] = '`' . $o . '`';                 }             }         } public function setGroupBy($groupBy, $qoute = true)         if ($groupBy) {             $this->groupBy = $groupBy;              if ($qoute && strpos($groupBy, '`') !== 0) {                 $this->groupBy = '`' . $this->groupBy . '`';             }         }  public function setValidOrders($validOrders)         return $this;     }      /**      * @param mixed $value      * @param int|null $type

Fixed version (after fix):
 public function setOrderKey($orderKey, $quote = true)                 if ($quote === false) {                     $this->orderKey[] = $o;                 } elseif ($this->isValidOrderKey($o)) {                     $this->orderKey[] = $this->quoteIdentifier($o);                 }             }         } public function setGroupBy($groupBy, $qoute = true)         if ($groupBy) {             $this->groupBy = $groupBy;            if ($qoute) {                 $quotedParts = [];                 $parts = explode(",", trim($groupBy, '`'));                 foreach($parts as $part) {                     $quotedParts[] = $this->quoteIdentifier(trim($part));                 }                  $this->groupBy = implode(", ", $quotedParts);             }         }  public function setValidOrders($validOrders)         return $this;     }      public function quoteIdentifier(string $value): string     {         $db = Db::get();          return $db->quoteIdentifier($value);     }      /**      * @param mixed $value      * @param int|null $type

Patch:
patch: @@ -235,7 +235,7 @@ public function setOrderKey($orderKey, $quote = true)
                 if ($quote === false) {
                     $this->orderKey[] = $o;
                 } elseif ($this->isValidOrderKey($o)) {
-                    $this->orderKey[] = '`' . $o . '`';
+                    $this->orderKey[] = $this->quoteIdentifier($o);
                 }
             }
         }
@@ -411,8 +411,14 @@ public function setGroupBy($groupBy, $qoute = true)
         if ($groupBy) {
             $this->groupBy = $groupBy;
 
-            if ($qoute && strpos($groupBy, '`') !== 0) {
-                $this->groupBy = '`' . $this->groupBy . '`';
+          if ($qoute) {
+                $quotedParts = [];
+                $parts = explode(",", trim($groupBy, '`'));
+                foreach($parts as $part) {
+                    $quotedParts[] = $this->quoteIdentifier(trim($part));
+                }
+
+                $this->groupBy = implode(", ", $quotedParts);
             }
         }
 
@@ -431,6 +437,13 @@ public function setValidOrders($validOrders)
         return $this;
     }
 
+    public function quoteIdentifier(string $value): string
+    {
+        $db = Db::get();
+
+        return $db->quoteIdentifier($value);
+    }
+
     /**
      * @param mixed $value
      * @param int|null $type
path: lib/Model/Listing/AbstractListing.php