CoreShop Vulnerable to SQL Injection via Admin Reports
Date: 2026-01
Affected: composer/coreshop/core-shop
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-22242
CWE: CWE-564
CWE-89
CVSS: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

### Affected Version(s) - CoreShop 4.1.2 Demo (tested) [Demo | CoreShop](https://docs.coreshop.com/CoreShop/Getting_Started/Demo/index.html) - Earlier versions may also be affected if the same code path exists ### Summary A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. ### Details The vulnerability occurs due to unsanitized user input being concatenated into a SQL query without proper parameterization. An attacker with administrative access can manipulate the affected parameter to influence the backend SQL query logic. Although no direct query output is returned, boolean and time-based inference techniques allow an attacker to extract data from the database. ### Impact **Vulnerability Type:** Blind SQL Injection **Impact:** Confidentiality only An attacker can: - Enumerate database schema - Extract all data accessible to the application’s database user **CVSS v3.1 (Base Score: 4.9 – Medium)** ``` CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N ``` ### Steps to Reproduce: <img width="1010" height="372" alt="1" src="https://github.com/user-attachments/assets/312422c8-f3ea-4332-8c14-59aed737da6a" /> 1. **Send a Normal Request:** - Request the


Mitigations:

Architectural layers (MAESTRO):