Database compromise via nested aggregation name injection

SQL injection in Shopware allows remote authenticated users to read and write database data through crafted search aggregations. The DAL aggregation parser checks only the top-level aggregation name, allowing recursive names to introduce prepared-statement placeholders that bind attacker-controlled filter values as SQL. Access to the Store API or Admin API is required; low-privileged backend access is sufficient to escalate privileges and compromise the database.