PT-2026-3891 · Coreshop · Coreshop
Bypazs
·
Published
2026-01-21
·
Updated
2026-02-17
·
CVE-2026-23959
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
CoreShop versions prior to 4.1.9
Description
An error-based SQL Injection issue exists in the
CustomerTransformerController within the CoreShop admin panel. The affected endpoint improperly incorporates user-supplied input into a SQL query, potentially leading to database error disclosure and data extraction. The vulnerability is located in the company name duplication check endpoint: /admin/coreshop/customer-company-modifier/duplication-name-check?value=. The $value parameter is user-controlled and not properly escaped or bound as a prepared statement parameter. Providing a double quote (") causes a SQL syntax error, confirming the injection point. The vulnerable file is /app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php, and the vulnerable code pattern is sprintf('name LIKE "%%%s%%"', (string) $value). Exploitation involves triggering a SQL error to confirm the injection and potentially extracting data.Recommendations
Versions prior to 4.1.9: Use parameterized queries instead of string concatenation or
sprintf to build SQL conditions. Apply strict input validation before processing user data. Handle database errors gracefully by returning controlled JSON error responses instead of raw 500 error pages.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Coreshop