Vulnerability: SQL Injection found in Pimcore Pimcore is an open source data & experience management platform. A SQL injection was discovered in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.
Vulnerability ID: GHSA-2v7p-f4qm-r5pc
CWE: CWE-89
Severity score: 7.5
Project: https://github.com/pimcore/pimcore
Published: 2022-04-23
File: bundles/AdminBundle/Helper/GridHelperService.php
Commit message: Fixed column quoting in GridHelperService
Commit author: Bernhard Rusch

Vulnerable version (before fix):
 public function getFilterCondition($filterJson, ClassDefinition $class, $tablePr                         } elseif ($filterField == 'id') {                             $conditionPartsFilters[] = 'oo_id ' . $operator . ' ' . $db->quote($filter['value']);                         } else {                             if ($filter['type'] == 'date' && $operator == '=') {                                 //if the equal operator is chosen with the date type, condition has to be changed                                 $maxTime = $filter['value'] + (86400 - 1); //specifies the top point of the range used in the condition                                 $conditionPartsFilters[] = '`o_' . $filterField . '` BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);                             } else {                                 $conditionPartsFilters[] = '`o_' . $filterField . '` ' . $operator . ' ' . $db->quote($filter['value']);                             }                         }                     } public function prepareAssetListingForGrid($allParams, $adminUser)                  if ($filterField == 'fullpath') {                     $filterField = 'CONCAT(path,filename)';                 }                  if (isset($filterDef[1]) && $filterDef[1] == 'system') {

Fixed version (after fix):
 public function getFilterCondition($filterJson, ClassDefinition $class, $tablePr                         } elseif ($filterField == 'id') {                             $conditionPartsFilters[] = 'oo_id ' . $operator . ' ' . $db->quote($filter['value']);                         } else {                             $filterField = $db->quoteIdentifier('o_' . $filterField);                             if ($filter['type'] == 'date' && $operator == '=') {                                 //if the equal operator is chosen with the date type, condition has to be changed                                 $maxTime = $filter['value'] + (86400 - 1); //specifies the top point of the range used in the condition                                 $conditionPartsFilters[] = $filterField . ' BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);                             } else {                                 $conditionPartsFilters[] = $filterField . ' ' . $operator . ' ' . $db->quote($filter['value']);                             }                         }                     } public function prepareAssetListingForGrid($allParams, $adminUser)                  if ($filterField == 'fullpath') {                     $filterField = 'CONCAT(path,filename)';                 }else {                     $filterField = $db->quoteIdentifier($filterField);                 }                  if (isset($filterDef[1]) && $filterDef[1] == 'system') {

Patch:
patch: @@ -332,12 +332,13 @@ public function getFilterCondition($filterJson, ClassDefinition $class, $tablePr
                         } elseif ($filterField == 'id') {
                             $conditionPartsFilters[] = 'oo_id ' . $operator . ' ' . $db->quote($filter['value']);
                         } else {
+                            $filterField = $db->quoteIdentifier('o_' . $filterField);
                             if ($filter['type'] == 'date' && $operator == '=') {
                                 //if the equal operator is chosen with the date type, condition has to be changed
                                 $maxTime = $filter['value'] + (86400 - 1); //specifies the top point of the range used in the condition
-                                $conditionPartsFilters[] = '`o_' . $filterField . '` BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);
+                                $conditionPartsFilters[] = $filterField . ' BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);
                             } else {
-                                $conditionPartsFilters[] = '`o_' . $filterField . '` ' . $operator . ' ' . $db->quote($filter['value']);
+                                $conditionPartsFilters[] = $filterField . ' ' . $operator . ' ' . $db->quote($filter['value']);
                             }
                         }
                     }
@@ -780,6 +781,8 @@ public function prepareAssetListingForGrid($allParams, $adminUser)
 
                 if ($filterField == 'fullpath') {
                     $filterField = 'CONCAT(path,filename)';
+                }else {
+                    $filterField = $db->quoteIdentifier($filterField);
                 }
 
                 if (isset($filterDef[1]) && $filterDef[1] == 'system') {
path: bundles/AdminBundle/Helper/GridHelperService.php