Pimcore, an Open Source Data & Experience Management Platform, contains a SQL injection vulnerability in the Admin Search Find API that affects versions prior to 12.3.1 and 11.5.14. The vulnerability stems from an incomplete patch for CVE-2023-30848, which attempted to mitigate SQL injection by removing SQL comments and catching syntax errors but was insufficient. Authenticated attackers can exploit this flaw to perform blind SQL injection attacks without relying on comments, potentially leading to database information disclosure through the admin interface. The vulnerability has been fixed in versions 12.3.1 and 11.5.14.