An authenticated SQL injection vulnerability in the Pimcore Admin Classic Bundle poses a high risk of total data compromise for affected backend systems.

This is an SQL injection flaw (CWE-89) within the backend UI, which requires the attacker to be authenticated (PR:L) to the Pimcore environment to trigger the malicious input.

Successful exploitation allows an authenticated attacker to bypass application logic and interact directly with the database. With a CVSS score of 8.8, this vulnerability could lead to the unauthorized extraction of sensitive business data, alteration of user permissions, or complete takeover of the Pimcore backend, resulting in significant operational and reputational damage.

Immediate Action: Update the Pimcore Admin Classic Bundle to version 1.7.18 or 2.3.6 depending on the installed branch.

Proactive Monitoring: Monitor application logs for suspicious database activity or unexpected backend requests that deviate from typical administrative workflows.

Compensating Controls: Implement strict database access controls and use a Web Application Firewall to block requests containing common SQL injection patterns.

Public Exploit Available: No confirmed public exploit available.

The availability of proof-of-concept material elevates the risk profile of this vulnerability. Administrators should apply the provided patches immediately to ensure the security of the backend infrastructure and protect the integrity of the underlying data.