Listen to this Post
The vulnerability is a blind SQL injection in the CoreShop e-commerce platform, specifically in the sales report functionality accessible to authenticated administrators. It originates from the ‘store’ parameter in the HTTP request, where user input is directly concatenated into an SQL query without sanitization or parameter binding. An attacker can manipulate this parameter to inject boolean-based or time-based SQL conditions. Since the application does not output direct database errors or results, the attacker must infer information by observing differences in response behavior. For instance, appending ‘AND 1=1’ to the parameter returns data, while ‘AND 2=1’ returns an empty set, confirming the injection point. Using automated tools like sqlmap, an attacker can perform inference attacks to extract sensitive database information such as the database schema, hostname, and all data accessible to the application’s read-only database user. The vulnerability is limited to confidentiality impact due to the restricted database permissions, preventing data modification or system disruption.
Platform: CoreShop
Version: 4.1.2 Demo
Vulnerability: Blind SQL Injection
Severity: Medium
date: Unknown
Prediction: No patch date
What Undercode Say:
Analytics
python sqlmap.py -r test.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080 -p store
$storeId =$parameterBag->get('store',null);
if (null ===$storeId) {
return [];
}
$store =$this->storeRepository->find($storeId);
WHERE orders.store =$storeId
How Exploit:
Send normal request.
Inject boolean true condition.
Inject boolean false condition.
Confirm injection behavior.
Use sqlmap automation.
Protection from this CVE
Strict type enforcement.
Use prepared statements.
Parameter binding.
Impact:
Confidentiality only.
Database schema enumeration.
Data extraction.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
