GHSA-r54v-qq87-px5r

Overview

Craft Commerce’s ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the unset() blocklist added to ElementIndexesController in GHSA-2453-mppf-46cj.

The blocklist only strips top-level Yii2 Query properties (where, orderBy, etc.), but hasVariant and hasProduct pass through untouched. Internally, these properties call Craft::configure() on a subquery without sanitization, re-introducing SQL injection via criteria[hasVariant][where]=INJECTED_SQL.

An authenticated control panel user can perform boolean-based blind SQL injection through the patched ElementIndexesController and extract arbitrary database contents.

Impact

• Full database read access via blind SQL injection
• Privilege escalation via security key extraction → forged admin sessions

Prerequisites

• Authenticated control panel user
• Commerce plugin installed
• Products with variants in the database