Craft Commerce: Blind SQL Injection via hasVariant/hasProduct

Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL injection to extract arbitrary database contents, including security keys that enable forging admin sessions for privilege escalation. This issue has been fixed in version 5.6.0.

N/A

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Craft Commerce SQL注入漏洞

Craft Commerce是Craft CMS开源的一个电子商务平台。 Craft Commerce 5.5.4及之前版本存在SQL注入漏洞，该漏洞源于ProductQuery::hasVariant和VariantQuery::hasProduct属性绕过输入清理阻止列表，可能导致SQL注入攻击。

N/A

N/A