CVE-2022-1339: 
PHP vulnerability analysis and mitigation

SQL injection vulnerability (CVE-2022-1339) was discovered in ElementController.php in GitHub repository pimcore/pimcore versions prior to 10.3.5. The vulnerability was disclosed on April 13, 2022, and allows attackers to steal data from the affected systems (NVD).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 base score of 7.5 (HIGH) according to NVD, and 8.8 (HIGH) according to huntr.dev. The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that it can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high confidentiality impact (NVD).

The vulnerability enables attackers to steal data from the affected systems through SQL injection techniques. The high CVSS score indicates significant potential impact on data confidentiality, though integrity and availability are not directly affected (NVD).

The vulnerability has been patched in pimcore version 10.3.5. Users are advised to upgrade to this version or later to mitigate the risk. The fix involves proper quoting of SQL conditions in the affected code (GitHub Patch).