GitHub Advisoryadvisory · Packagist

GHSA-hm9j-cgmm-2w36 Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

HIGH Published 2026-01-15 Modified 2026-01-15 Official page ↗
Aliases
CVE-2021-47763
Ecosystem
Packagist
Packages
aimeos/aimeos-laravel
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-89
Reviewed
2026-01-15

Affected packages

• Packagist aimeos/aimeos-laravel: 2021.10 (no fix yet)

Description

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.

Related

Alias · CVE (1)

  • CVE-2021-47763 Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References