GitHub Security Advisory: GHSA-ch7p-mpv4-4vg4
Package: coreshop/core-shop (COMPOSER)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-564: SQL Injection: Hibernate
Vulnerable versions: <= 4.1.7
Patched in: 4.1.8

Summary: CoreShop Vulnerable to SQL Injection via Admin Reports

Details:
### Affected Version(s)

- CoreShop 4.1.2 Demo (tested) [Demo | CoreShop](https://docs.coreshop.com/CoreShop/Getting_Started/Demo/index.html)
- Earlier versions may also be affected if the same code path exists

### Summary

A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques.
The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

### Details

The vulnerability occurs due to unsanitized user input being concatenated into a SQL query without proper parameterization.

An attacker with administrative access can manipulate the affected parameter to influence the backend SQL query logic. Although no direct query output is returned, boolean and time-based inference techniques allow an attacker to extract data from the database.


### Impact

**Vulnerability Type:** Blind SQL Injection

**Impact:** Confidentiality only

An attacker can:

- Enumerate database schema
- Extract all data accessible to the application’s database user

**CVSS v3.1 (Base Score: 4.9 – Medium)**

```
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
```

### Steps to Reproduce:

<img width="1010" height="372" alt="1" src="https://github.com/user-attachments/assets/312422c8-f3ea-4332-8c14-59aed737da6a" />

1. **Send a Normal Request:**
    - Request the report endpoint with a valid `store` value (e.g. `store=1`) and observe that data is returned.
    
<img width="1259" height="725" alt="2" src="https://github.com/user-attachments/assets/56f91c23-bae5-4edf-9c17-c776c323b3a8" />

2. **Inject a Boolean TRUE Condition:**
    - Modify the parameter to `store=1 AND 1=1`.
    - The response returns the same data as the normal request.
    
<img width="1269" height="725" alt="3" src="https://github.com/user-attachments/assets/c998065a-dc59-4fe5-8be9-d5ea82736ade" />

3. **Inject a Boolean FALSE Condition:**
    - Modify the parameter to `store=1 AND 2=1`.
    - The response returns an empty dataset.
    
<img width="1259" height="536" alt="4" src="https://github.com/user-attachments/assets/3be68566-f1f3-4a61-81d7-4f8b0b318bf7" />

4. **Confirm Injection Behavior:**
    - The difference between TRUE and FALSE conditions confirms that the `store` parameter directly affects SQL query logic, indicating a boolean-based blind SQL injection.
    
5. **Automated Confirmation Using sqlmap:**
    - The vulnerable request was tested using `sqlmap` with the `store` parameter.
    - sqlmap successfully confirmed the parameter as **boolean-based and time-based blind SQL injectable**.
    - The tool was able to fingerprint the backend environment, including:
        - Database Management System (DBMS)
        - Database hostname
        - PHP version
        - Available database names
    - This confirms that the injection is exploitable beyond si