CVE-2023-3673 (published 2023-07-14T13:15Z)

 SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/pimcore/pimcore
commit_details: repo_url: https://github.com/pimcore/pimcore
author: JiaJia Ji
author_date: 2023-06-14 12:33:22+02:00
msg: [Task]: Improve Admin translation and application logger sorting (#15303)

* task: improve valid key for translation listing

* task: force the direction to be ASC/DESC since these are the only valid options

* task: quote application logger sorting setting

* task: add backend search grid valid order keys
repository: repo_url: https://github.com/pimcore/pimcore
repo_name: pimcore/pimcore
description: Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)
repo_language: PHP
owner: pimcore
file_changes: filename: LogController.php
change_type: ModificationType.MODIFY
diff: @@ -67,7 +67,7 @@ class LogController extends AdminController implements KernelControllerEventInte
         ));
 
         if ($sortingSettings['orderKey']) {
-            $qb->orderBy($sortingSettings['orderKey'], $sortingSettings['order']);
+            $qb->orderBy($db->quoteIdentifier($sortingSettings['orderKey']), $sortingSettings['order']);
         } else {
             $qb->orderBy('id', 'DESC');
         }

programming_language: PHP
filename: TranslationController.php
change_type: ModificationType.MODIFY
diff: @@ -443,6 +443,7 @@ class TranslationController extends AdminController
 
             $list->setOrder('asc');
             $list->setOrderKey($tableName . '.key', false);
+            $list->setLanguages($validLanguages);
 
             $sortingSettings = \Pimcore\Bundle\AdminBundle\Helper\QueryParams::extractSortingSettings(
                 array_merge($request->request->all(), $request->query->all())

programming_language: PHP
filename: QueryParams.php
change_type: ModificationType.MODIFY
diff: @@ -37,12 +37,12 @@ class QueryParams
             $sortParam = json_decode($sortParam, true);
             $sortParam = $sortParam[0];
 
+            $order = strtoupper($sortParam['direction']) === 'DESC' ? 'DESC' : 'ASC';
+
             if (substr($sortParam['property'], 0, 1) != '~') {
                 $orderKey = $sortParam['property'];
-                $order = $sortParam['direction'];
             } else {
                 $orderKey = $sortParam['property'];
-                $order = $sortParam['direction'];
 
                 $parts = explode('~', $orderKey);
 

programming_language: PHP
filename: Listing.php
change_type: ModificationType.MODIFY
diff: @@ -52,4 +52,30 @@ class Listing extends \Pimcore\Model\Listing\AbstractListing
     {
         $this->initDao(__CLASS__);
     }
+
+    /**
+     * @inheritdoc
+     */
+    public function isValidOrderKey($key)
+    {
+        return in_array(
+            $key,
+            [
+                'type',
+                'id',
+                'key',
+                'index',
+                'fullpath',
+                'maintype',
+                'subtype',
+                'published',
+                'creationDate',
+                'modificationDate',
+                'userOwner',
+                'userModification',
+                'data',
+                'properties'
+            ]
+        );
+    }
 }

programming_language: PHP
filename: Listing.php
change_type: ModificationType.MODIFY
diff: @@ -51,6 +51,14 @@ class Listing extends Model\Listing\AbstractListing
      */
     protected ?array $languages = null;
 
+    /**
+     * @inheritdoc
+     */
+    public function isValidOrderKey($key)
+    {
+        return in_array($key, ['key', 'type']) || in_array($key, $this->getLanguages());
+    }
+
     /**
      * @return string
      */

programming_language: PHP