An authenticated user can trigger a time-based blind SQL injection in the DateFilter column key parameter of Pimcore Studio Backend Bundle. The unsanitized column key is interpolated directlytick to escape the literal context and inject subqueries such as SLEEP() or IF(). This flaw permits the attacker to exfiltrate database contents, including administrator password hashes, in a sequential manner. The vulnerability is a classic instance of CWE-89 and results in a confident breach of confidentiality.

The issue is present in Pimcore Studio Backend Bundle versions earlier than 2025.4.6 and 2026.1.6. All other versions are unaffected. The vulnerability manifests through the POST /pimcore-studio/api/website-settings endpoint and other listing endpoints that accept a columnFilters array.

The CVSS score of 7.7 indicates a high severity exploit. EPSS is < 1%, and the vulnerability is not listed in CISA KEV. The attack requires that the user be authenticated to the application, and hinges on the ability to send crafted POST requests to the API endpoints. While the, time-based injection rather than a direct data read, repeated requests can reveal sensitive values. Given the potential to retrieve administrator password hashes, the risk to an environment where privileged users exist is substantial.