Craft CMS Element Search SQL Injection Vulnerability

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contain an unauthenticated SQL injection vulnerability in the element search endpoint.

The flaw exists because the attribute parameter is concatenated into the query unsanitized, and emulated PDO prepares allow stacked statements.

• Affected versions: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2
• Remote attackers can read and write the database
• Attackers can set the admin flag or overwrite password hashes in the users table to gain administrator access