CVE-2026-22242: CoreShop Pimcore SQL Injection Vulnerability

CVE-2026-22242 Overview

CVE-2026-22242 is a blind SQL injection vulnerability discovered in CoreShop, a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, the application contains a security flaw that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based SQL injection techniques. While the database account used by the application is read-only and non-DBA, this vulnerability still enables confidential data disclosure from the underlying database.

Critical Impact

Authenticated administrators can extract sensitive database contents through blind SQL injection, potentially exposing customer data, order information, and other confidential eCommerce data stored in the Pimcore database.

Affected Products

• CoreShop versions prior to 4.1.8
• Pimcore installations with CoreShop eCommerce bundle
• CoreShop Report functionality (AbandonedCartsReport, CarriersReport)

Discovery Timeline

• January 8, 2026 - CVE-2026-22242 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22242

Vulnerability Analysis

This blind SQL injection vulnerability exists within the CoreShop reporting functionality. The vulnerability allows authenticated administrator users to manipulate SQL queries through unsanitized input parameters. Due to the nature of blind SQL injection, attackers cannot directly view the results of injected queries but can infer database contents through boolean-based or time-based techniques.

The impact is limited to confidentiality breaches since the database account is configured as read-only and non-DBA. This means attackers cannot modify data or disrupt service availability. However, the ability to extract database contents poses significant risks to customer privacy and business confidentiality.

Root Cause

The root cause is improper handling of user-supplied input in SQL queries within the CoreShop reporting modules. The vulnerable code directly interpolates variables such as $storeId, $fromTimestamp, $toTimestamp, $offset, and $limit into SQL query strings without proper parameterization or sanitization. This allows SQL injection payloads to be executed against the database.

Attack Vector

The attack requires network access and high privileges (administrator authentication). An attacker with valid administrator credentials can exploit the reporting functionality by manipulating request parameters that are passed to SQL queries. The attacker can then use boolean-based inference (observing different application responses) or time-based inference (measuring query execution delays) to extract data character by character.

// Vulnerable code pattern (before patch)
// Source: https://github.com/coreshop/CoreShop/commit/59e84fec59d113952b6d28a9b30c6317f9e6e5dd

                         LEFT JOIN object_$userClassId AS `user` ON `user`.oo_id = cart.customer__id
                         LEFT JOIN coreshop_payment_provider AS `pg` ON `pg`.id = cart.paymentProvider
                         WHERE cart.items <> ''
-                          AND cart.store = $storeId
-                          AND cart.creationDate > ?
-                          AND cart.creationDate < ?
+                          AND cart.store = :storeId
+                          AND cart.creationDate > :fromTimestamp
+                          AND cart.creationDate < :toTimestamp
                           AND cart.saleState = '" . OrderSaleStates::STATE_CART . "'
                      GROUP BY cart.oo_id
                      ORDER BY cart.creationDate DESC
-                     LIMIT $offset,$limit";
+                     LIMIT " . (int) $offset . ', ' . (int) $limit;

-        $data = $this->db->fetchAllAssociative($sqlQuery, [$fromTimestamp, $toTimestamp]);
+        $data = $this->db->fetchAllAssociative($sqlQuery, [
+            'storeId' => $storeId,
+            'fromTimestamp' => $fromTimestamp,
+            'toTimestamp' => $toTimestamp,
+        ]);
         $this->totalRecords = (int) $this->db->fetchOne('SELECT FOUND_ROWS()');

         foreach ($data as &$entry) {

Source: GitHub Commit Update

Detection Methods for CVE-2026-22242

Indicators of Compromise

• Unusual or malformed parameters in requests to CoreShop reporting endpoints
• Database query logs showing unexpected SQL syntax or timing functions (e.g., SLEEP(), BENCHMARK())
• Multiple sequential requests to report generation APIs with incrementally varying parameters
• Administrator accounts accessing reporting functionality from unexpected IP addresses or at unusual times

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns in requests to /admin/ endpoints
• Implement database query logging and alert on queries containing suspicious functions like SLEEP(), IF(), or CASE WHEN statements
• Review access logs for administrator reporting endpoints showing patterns consistent with automated extraction tools
• Deploy SentinelOne Singularity to detect anomalous database query patterns and application-layer attacks

Monitoring Recommendations

• Enable detailed logging for all CoreShop administrative actions, particularly report generation
• Configure alerts for database queries exceeding normal execution time thresholds
• Monitor administrator session activity for signs of credential compromise or insider threats
• Implement rate limiting on reporting API endpoints to slow automated extraction attempts

How to Mitigate CVE-2026-22242

Immediate Actions Required

• Upgrade CoreShop to version 4.1.8 or later immediately
• Review administrator account access and audit for any unauthorized activity
• Examine database query logs for evidence of exploitation attempts
• Restrict administrator access to trusted IP addresses where feasible

Patch Information

CoreShop has addressed this vulnerability in version 4.1.8. The patch converts vulnerable direct variable interpolation to parameterized queries using named placeholders (:storeId, :fromTimestamp, :toTimestamp) and explicit integer casting for pagination parameters. Organizations should apply this update through their standard Pimcore/CoreShop update process.

For detailed patch information, refer to:

• GitHub Security Advisory GHSA-ch7p-mpv4-4vg4
• GitHub Commit Update

Workarounds

• Restrict access to CoreShop administrative reporting functionality to only essential personnel until patched
• Implement web application firewall rules to detect and block SQL injection patterns in request parameters
• Configure database user permissions to further limit data access scope where possible
• Enable database query auditing to detect and alert on suspicious query patterns

# Configuration example - Restrict admin access via web server (nginx)
location /admin/ {
    allow 10.0.0.0/8;      # Internal network
    allow 192.168.1.0/24;  # Office network
    deny all;
    
    # Additional rate limiting
    limit_req zone=admin_limit burst=5 nodelay;
}