SQL Injection in Admin download files as zip
SummaryThe application allows to create zip files from available files on the site. The parameter "selectedIds", is susceptible to SQL Injection.Details[downloadAsZipJobsAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2006) escape parameters, but [downloadAsZipAddFilesAction](https://github.com/pimcore/admin-ui-classic-bundle/blob/1.x/src/Controller/Admin/Asset/AssetController.php#L2087) not.
The following code should be added:PoCSet up an example project as described on https://github.com/pimcore/demon (demo package with example content)Log In. Grab the `X-pimcore-csrf-token` header from any request to the backend, as well as the `PHPSESSID` cookie.Run the following script, substituting the values accordingly:The response is delayed by 6 seconds.ImpactAny backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level.