Order By: Pwn - Unauthenticated SQL Injection in Aimeos
Vulnerability ID: CVE-2021-47763
CVSS Score: 8.2
Published: 2026-01-15
An unauthenticated SQL injection vulnerability in the Aimeos Laravel e-commerce platform allows attackers to execute arbitrary SQL commands via the 'sort' parameter in the JSON API.
TL;DR
The Aimeos JSON API failed to validate the 'sort' parameter, passing it directly into a database query's 'ORDER BY' clause. This allows unauthenticated attackers to inject SQL fragments, triggering database errors that reveal schema information. While discovered in 2021, this high-severity flaw (CVSS 8.2) highlights the persistent danger of dynamic query construction.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-89 (SQL Injection)
- Attack Vector: Network (Unauthenticated)
- CVSS v3.1: 8.2 (High)
- Impact: Confidentiality (High), Integrity (Low)
- Exploit Status: PoC Available
- Vulnerable Component: JSON API / sort parameter
Affected Systems
- Aimeos Laravel E-commerce Platform (2021.10 LTS)
-
Aimeos Laravel: = 2021.10 LTS (Fixed in:
Latest 2021.x / 2022.x)
Exploit Details
- Exploit-DB: Proof of Concept for SQL Injection via sort parameter
Mitigation Strategies
- Input Validation (Allow-listing)
- Disable Verbose Error Reporting
- WAF Filtering
Remediation Steps:
- Upgrade 'aimeos/aimeos-laravel' via Composer to the latest patched version.
- Set 'APP_DEBUG=false' in the production .env file.
- Review custom code extending Aimeos managers to ensure manual queries utilize allow-lists for sort parameters.
References
Read the full report for CVE-2021-47763 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)