CVE-2022-24752— SQL Injection through sorting parameters in SyliusGridBundle
Quick assessment
Affected
Sylius SyliusGridBundle
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SyliusGridBundle是一个开源电子商务解决方案，由具有强大 API 和最高质量代码的解耦组件构建而成。 SyliusGridBundle 1.10.1 和 1.11-rc2 版本之前存在SQL注入漏洞，该漏洞源于在查询排序结束时添加的值会直接传递到数据库。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-24752
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL Injection through sorting parameters in SyliusGridBundle
Source: CVE Program / CVE List V5
Vulnerability Description
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
SyliusGridBundle SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SyliusGridBundle是一个开源电子商务解决方案，由具有强大 API 和最高质量代码的解耦组件构建而成。 SyliusGridBundle 1.10.1 和 1.11-rc2 版本之前存在SQL注入漏洞，该漏洞源于在查询排序结束时添加的值会直接传递到数据库。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Sylius | SyliusGridBundle | < 1.10.1 | - |
|
II. Public POCs for CVE-2022-24752
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-24752
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-24752 (2)
-
https://github.com/Sylius/SyliusGridBundle/pull/222 x_refsource_MISC
Vendor Advisories for CVE-2022-24752 (1)
Other References for CVE-2022-24752 (2)
-
https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.11.0-RC.2 x_refsource_MISC
-
https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.10.1 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: Sylius
-
CVE-2026-68501
Sylius Mollie Plugin: Unauthenticated IDOR leaks order token -
CVE-2026-68500
Sylius Mollie Plugin: Payment status forgery via the payment -
CVE-2026-31825
Sylius has a DQL Injection via API Order Filters -
CVE-2026-31824
Sylius has a Promotion Usage Limit Bypass via Race Condition -
CVE-2026-31823
Sylius has Authenticated Stored XSS
Same weakness: CWE-89
-
CVE-2026-32551
WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vuln -
CVE-2026-32478
WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injec -
CVE-2026-32471
WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection -
CVE-2026-78270
WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vul -
CVE-2026-78246
itsourcecode Online Clinic Management System Admin Login log
V. Comments for CVE-2022-24752
No comments yet