Remote code execution in Pimcore CMS

[Pedro Ribeiro <pedrib () gmail com>]

Hi,

I have discovered a PHP object injection in Pimcore CMS.

Depending on the PHP version under which Pimcore is running, it is possible
to achieve remote code execution in the worst case, and arbitrary file
deletion at best.

Please find attached the report, which is also available at

https://github.com/pedrib/PoC/blob/master/pimcore-2.1.0.txt

Can you please provide a CVE number for this?

Thanks in advance.

Regards
Pedro

Attachment: pimcore-2.1.0.txt
Description: