CVE-2026-23959: CoreShop SQL Injection Vulnerability

CVE-2026-23959 Overview

CoreShop, a Pimcore enhanced eCommerce solution, contains an error-based SQL Injection vulnerability in the CustomerTransformerController within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query without proper parameterization, leading to database error disclosure and potential data extraction. This vulnerability affects all CoreShop versions prior to 4.1.9.

Critical Impact

Authenticated attackers with administrative privileges can exploit this SQL Injection vulnerability to extract sensitive data from the underlying database, potentially exposing customer information, order details, and other confidential eCommerce data.

Affected Products

• CoreShop versions prior to 4.1.9
• Pimcore installations using vulnerable CoreShop eCommerce bundle
• CoreShop admin panel with CustomerTransformerController endpoint

Discovery Timeline

• 2026-01-22 - CVE-2026-23959 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-23959

Vulnerability Analysis

This SQL Injection vulnerability (CWE-564) exists in the CustomerTransformerController.php file within CoreShop's admin panel. The vulnerability stems from improper handling of user-supplied input when constructing database queries for company lookups. The application directly interpolates the user-provided $value variable into a SQL LIKE clause using string formatting, rather than utilizing parameterized queries or prepared statements.

The attack requires network access and high privileges (administrative access to the CoreShop admin panel). While exploitation requires authenticated access, a successful attack can result in high confidentiality impact through database information disclosure, including potential extraction of sensitive customer and transaction data.

Root Cause

The root cause is the use of direct string interpolation with sprintf() to construct SQL queries in the CustomerTransformerController. The vulnerable code constructs a LIKE condition by embedding user input directly into the SQL string using sprintf('name LIKE \"%%%s%%\"', (string) $value). This pattern bypasses any database-level escaping and allows an attacker to manipulate the SQL query structure through specially crafted input values.

Attack Vector

The attack vector is network-based, targeting the CoreShop admin panel endpoint handling company lookups. An authenticated administrator can supply malicious input through the affected parameter, which gets directly concatenated into the SQL query. By injecting SQL metacharacters and syntax, attackers can trigger database errors that reveal schema information, or use techniques like UNION-based or boolean-based blind SQL injection to extract data from the database.

// Vulnerable code pattern (before patch)
$list->addConditionParam(sprintf('name LIKE "%%%s%%"', (string) $value));

// Fixed code pattern (after patch) - uses parameterized query
$list->addConditionParam('name LIKE ?', '%' . $value . '%');

Source: GitHub Commit Update

Detection Methods for CVE-2026-23959

Indicators of Compromise

• Unusual or malformed requests to the CoreShop admin panel customer transformer endpoints containing SQL metacharacters such as single quotes, double quotes, or comment sequences
• Database error messages appearing in application logs or HTTP responses related to company name lookups
• Anomalous patterns in database query logs showing modified LIKE clauses or injected SQL syntax
• Unexpected database access patterns or queries returning abnormally large result sets

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads in requests to the CoreShop admin panel
• Monitor application logs for database error messages that may indicate SQL injection attempts
• Enable database query auditing to identify unusual query patterns targeting the company lookup functionality
• Review access logs for repeated requests to the CustomerTransformerController endpoint with varying payloads

Monitoring Recommendations

• Enable detailed logging on the CoreShop admin panel and database server to capture potential exploitation attempts
• Configure alerting for HTTP 500 errors or database exceptions originating from the customer transformer controller
• Implement rate limiting on admin panel endpoints to slow down automated exploitation attempts
• Monitor for any unauthorized data access patterns in database audit logs

How to Mitigate CVE-2026-23959

Immediate Actions Required

• Upgrade CoreShop to version 4.1.9 or later immediately to remediate the SQL Injection vulnerability
• Review database access logs for any signs of prior exploitation attempts
• Audit administrative user accounts for unauthorized access and rotate credentials as a precaution
• Implement network-level restrictions to limit admin panel access to trusted IP addresses

Patch Information

CoreShop version 4.1.9 addresses this vulnerability by replacing the vulnerable string interpolation with parameterized query binding. The fix modifies the addConditionParam() call to use placeholder syntax with the value passed as a separate parameter, ensuring proper escaping by the database layer. Organizations should update to version 4.1.9 or later. For detailed information, refer to the GitHub Security Advisory GHSA-fqcv-8859-86x2 and the CoreShop 4.1.9 Release.

Workarounds

• Restrict admin panel access to trusted networks using firewall rules or VPN requirements until patching is complete
• Implement a reverse proxy or WAF with SQL injection detection capabilities in front of the CoreShop application
• Disable or restrict access to the customer transformer functionality if not business-critical
• Monitor and alert on any requests containing SQL injection patterns targeting admin endpoints

# Example: Restrict admin panel access via nginx
location /admin {
    # Allow only trusted IP ranges
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    # Additional security headers
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
}