CVE-2020-15146: 
PHP vulnerability analysis and mitigation

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2, and 1.6.4, request parameters injected inside an expression evaluated by symfony/expression-language package were not properly sanitized. This vulnerability was discovered and disclosed in August 2020, affecting multiple versions of the SyliusResourceBundle package (GitHub Advisory).

The vulnerability exists in the OptionsParser component where request parameters used within expression language evaluations lack proper sanitization. When processing expressions in the format 'expr:service(repository).find($id)', the $id parameter could be manipulated to call unauthorized services. The issue was present in versions <=1.3.13, >=1.4.0 <=1.4.6, >=1.5.0 <=1.5.1, and >=1.6.0 <=1.6.3 (GitHub Advisory).

The vulnerability allows attackers to access any public service by manipulating request parameters, potentially leading to Remote Code Execution (RCE). For example, an attacker could craft a malicious URL parameter to execute arbitrary database queries through the doctrine service (GitHub Advisory).

The vulnerability can be exploited by manipulating request parameters in any routing definition that uses request parameters inside expression language. For instance, visiting a URL with a crafted parameter like '?id="~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"' could result in unauthorized database operations (GitHub Advisory).

The issue has been patched in versions 1.3.14, 1.4.7, 1.5.2, and 1.6.4. The fix involves adding addslashes in OptionsParser::parseOptionExpression to sanitize user input before evaluation. Versions prior to 1.3 were not patched. Users should upgrade to the patched versions immediately (GitHub Advisory).