Pimcore's Admin Classic Bundle allows a SQL injection attack through the translation grid date filter when the user supplies an unsanitized "property" value. The parameter is directly inserted into a "UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))" SQL expression without any validation or parameterization, enabling an attacker to inject arbitrary SQL. This flaw can give an attacker unauthorized read or write access to the database, effectively leading to remote code execution or data compromise. The vulnerability is classified as CWE‑89.

Products affected are Pimcore’s Admin Classic Bundle versions earlier than 2.3.6 and 1.7.18. The issue exists in the backend UI that handles translation grid filtering. Upgrading to the fixed releases 2.3.6 or 1.7.18 removes the vulnerability.

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available, suggesting limited publicly known exploitation data. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through the backend administrative interface; thus an attacker would need access to the admin UI to supply the malicious property value. Successful exploitation would give the attacker the ability to execute arbitrary database queries, potentially compromising data integrity, confidentiality, and availability.