CVE-2026-23492: 
PHP vulnerability analysis and mitigation

CVE-2026-23492 is a blind SQL injection vulnerability in Pimcore's Admin Search Find API, resulting from an incomplete patch for the previously disclosed CVE-2023-30848. It affects Pimcore versions prior to 11.5.14 (11.x branch) and versions 12.0.0-RC1 through 12.3.0 (12.x branch). The vulnerability was published on January 14, 2026, and is classified as High severity with a CVSS v3.1 base score of 4.9 per NVD (network-accessible, high privileges required, confidentiality impact only), though the GitHub Advisory Database rates it 8.8 based on broader impact assumptions (Github Advisory, Pimcore Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in the findAction method of SearchController.php at the /admin/search/search/find endpoint. The prior fix for CVE-2023-30848 only stripped -- SQL comment sequences and caught SyntaxErrorException, but left the attacker-controlled fields[] GET parameter unsanitized against comment-free injection techniques. Attackers can inject boolean-based or time-based blind SQL payloads (e.g., AND (SELECT CASE WHEN (1=1) THEN 1 ELSE 0 END)=1 or AND IF(1=1,SLEEP(5),0)) that do not trigger syntax errors, allowing inference of database contents through response timing or conditional behavior differences. A public proof-of-concept is included in the GitHub security advisory (Pimcore Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to enumerate the database schema and extract sensitive data through blind SQL injection techniques, potentially achieving full database compromise depending on the database user's privileges. The primary impact is high confidentiality loss (database information disclosure), with potential integrity and availability impacts if the database account permits write or administrative operations. The attack surface is limited to the admin interface, but any authenticated admin-level user can exploit it without additional user interaction (Pimcore Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the Pimcore GitHub security advisory, demonstrating both boolean-based and time-based blind SQL injection techniques. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.003% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authenticated access to the Pimcore admin interface, which limits the attack surface (Pimcore Advisory, Github Advisory).

1. Authenticate: Obtain valid credentials for the Pimcore admin interface (e.g., through phishing, credential stuffing, or insider access) and log in to gain an authenticated session.
2. Identify the vulnerable endpoint: Navigate to or directly target the Admin Search Find API at /admin/search/search/find.
3. Craft a boolean-based blind injection payload: Send a GET request with a malicious fields[] parameter, such as:

   GET /admin/search/search/find?query=2&fields[]=field1 AND (SELECT CASE WHEN (1=1) THEN 1 ELSE 0 END)=1~field2&filter=[{"property":"value"}]&class=classname

   Observe whether the response differs when the condition is true vs. false to confirm injection.
4. Craft a time-based blind injection payload: Use a time-delay payload to confirm execution:

   GET /admin/search/search/find?query=2&fields[]=field1 AND IF(1=1,SLEEP(5),0)~field2&filter=[{"property":"value"}]&class=classname

   A ~5 second response delay confirms the injected SQL is executed.
5. Enumerate the database: Use automated tools (e.g., sqlmap with a captured authenticated request) to systematically extract database schema names, table names, and sensitive data via blind inference techniques.
6. Exfiltrate data: Extract target data (credentials, PII, configuration secrets) character by character using boolean or time-based conditions (Pimcore Advisory).

• Network: Unusual or repeated GET requests to /admin/search/search/find with fields[] parameters containing SQL keywords such as AND, SELECT, CASE, WHEN, SLEEP, IF, or encoded equivalents; requests with abnormally long or structured fields[] values.
• Logs: Web server or application logs showing sequential requests to the search endpoint with slight variations in the fields[] parameter (indicative of automated blind injection enumeration); requests resulting in delayed responses (~5 seconds) suggesting time-based injection.
• Application Behavior: Repeated admin search queries with no apparent legitimate search purpose, especially from a single authenticated session or IP address in rapid succession.
• Database: Unusual query patterns in database slow query logs involving SLEEP(), IF(), or CASE WHEN constructs originating from the Pimcore application user (Pimcore Advisory).

Upgrade Pimcore to version 11.5.14 (for the 11.x branch) or 12.3.1 (for the 12.x branch), which contain the complete fix for this vulnerability. Until patching is complete, restrict access to the Pimcore admin interface to trusted IP addresses only, and enforce the principle of least privilege for admin accounts. Monitor admin search API usage for suspicious query patterns as a compensating control (Pimcore Advisory, Github Advisory).

The vulnerability was reported by researcher Snow1nd and published via the Pimcore GitHub security advisory on January 14, 2026. It received coverage from The Hacker Wire and was noted in vulnerability tracking communities including Mastodon and Bluesky shortly after disclosure. No major vendor statements beyond the official Pimcore advisory have been identified, and community reaction has been moderate given the authenticated-only attack requirement (Pimcore Advisory).