An SQL injection flaw exists in the Pimcore admin‑ui‑classic‑bundle up to version 2.3. The DataObject grid id column filter concatenates user input directly into the SQL WHERE clause without parameterization, enabling an authenticated backend user to execute arbitrary SQL statements. If exploited, the attacker can extract, alter, or delete any data stored in the database, compromising both confidentiality and integrity of the system.

All deployments of Pimcore admin‑ui‑classic‑bundle with versions 2.3 and earlier. This includes the default installation bundled with Pimcore platforms that ship the classic admin‑UI. No specific operating system or database platform is required beyond normal backend access to Pimcore.

The CVSS base score of 8.8 indicates a high severity vulnerability that can be leveraged by attackers who have authenticated backend access. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog; however, because an attacker must first authenticate to the backend, it requires privileged credentials but can still enable total database compromise once access is obtained. The lack of input validation in the filter logic makes the flaw straightforward to exploit under these conditions.