GHSA-r54v-qq87-px5rhigh8.7

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Summary

The imported advisory is rated high severity. It identifies 1 affected package; whether you are affected depends on your installed version. It is not listed in the imported CISA KEV data; that does not establish that exploitation has not occurred.

Summary by cve.new · CC BY 4.0

Original source description

Overview

Craft Commerce’s ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the unset() blocklist added to ElementIndexesController in GHSA-2453-mppf-46cj.

The blocklist only strips top-level Yii2 Query properties (where, orderBy, etc.), but hasVariant and hasProduct pass through untouched. Internally, these properties call Craft::configure() on a subquery without sanitization, re-introducing SQL injection via criteria[hasVariant][where]=INJECTED_SQL.

An authenticated control panel user can perform boolean-based blind SQL injection through the patched ElementIndexesController and extract arbitrary database contents.

Impact

Full database read access via blind SQL injection
Privilege escalation via security key extraction → forged admin sessions

Prerequisites

Authenticated control panel user
Commerce plugin installed
Products with variants in the database

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

craftcms/commerce Packagist

Ecosystem versions

From 5.0.0 before 5.6.0

Fixed in 5.6.0

89 explicitly affected versions

5.0.0, 5.0.1, 5.0.10, 5.0.10.1, 5.0.11, 5.0.11.1, 5.0.12, 5.0.12.1, 5.0.12.2, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.16.1, 5.0.16.2, 5.0.17, 5.0.18, 5.0.19, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.1.0, 5.1.0-beta.1, 5.1.0-beta.2, 5.1.0-beta.3, 5.1.0.1, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.2.0, 5.2.1, 5.2.10, 5.2.11, 5.2.12, 5.2.12.1, 5.2.2, 5.2.2.1, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.9.1, 5.3.0, 5.3.0.1, 5.3.0.2, 5.3.1, 5.3.10, 5.3.11, 5.3.12, 5.3.13, 5.3.2, 5.3.2.1, 5.3.2.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 5.3.8, 5.3.9, 5.4.0, 5.4.1, 5.4.1.1, 5.4.10, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.5.1, 5.4.6, 5.4.7, 5.4.7.1, 5.4.8, 5.4.9, 5.5.0, 5.5.0.1, 5.5.1, 5.5.2, 5.5.3, 5.5.4

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.0.0"
        },
        {
          "fixed": "5.6.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.0.0",
    "5.0.1",
    "5.0.10",
    "5.0.10.1",
    "5.0.11",
    "5.0.11.1",
    "5.0.12",
    "5.0.12.1",
    "5.0.12.2",
    "5.0.13",
    "5.0.14",
    "5.0.15",
    "5.0.16",
    "5.0.16.1",
    "5.0.16.2",
    "5.0.17",
    "5.0.18",
    "5.0.19",
    "5.0.2",
    "5.0.3",
    "5.0.4",
    "5.0.5",
    "5.0.6",
    "5.0.7",
    "5.0.8",
    "5.0.9",
    "5.1.0",
    "5.1.0-beta.1",
    "5.1.0-beta.2",
    "5.1.0-beta.3",
    "5.1.0.1",
    "5.1.1",
    "5.1.2",
    "5.1.3",
    "5.1.4",
    "5.2.0",
    "5.2.1",
    "5.2.10",
    "5.2.11",
    "5.2.12",
    "5.2.12.1",
    "5.2.2",
    "5.2.2.1",
    "5.2.3",
    "5.2.4",
    "5.2.5",
    "5.2.6",
    "5.2.7",
    "5.2.8",
    "5.2.9",
    "5.2.9.1",
    "5.3.0",
    "5.3.0.1",
    "5.3.0.2",
    "5.3.1",
    "5.3.10",
    "5.3.11",
    "5.3.12",
    "5.3.13",
    "5.3.2",
    "5.3.2.1",
    "5.3.2.2",
    "5.3.3",
    "5.3.4",
    "5.3.5",
    "5.3.6",
    "5.3.7",
    "5.3.8",
    "5.3.9",
    "5.4.0",
    "5.4.1",
    "5.4.1.1",
    "5.4.10",
    "5.4.2",
    "5.4.3",
    "5.4.4",
    "5.4.5",
    "5.4.5.1",
    "5.4.6",
    "5.4.7",
    "5.4.7.1",
    "5.4.8",
    "5.4.9",
    "5.5.0",
    "5.5.0.1",
    "5.5.1",
    "5.5.2",
    "5.5.3",
    "5.5.4"
  ]
}

Set up in your agent.

Investigate in your agent.