CVE-2026-22242: 
PHP vulnerability analysis and mitigation

CVE-2026-22242 is a blind SQL injection vulnerability in CoreShop, a Pimcore-based eCommerce solution, affecting all versions up to and including 4.1.7. The flaw allows an authenticated administrator-level user to extract database contents via boolean-based or time-based inference techniques through the admin reports endpoint. It was disclosed on January 7, 2026, via a GitHub Security Advisory, and published to the NVD on January 8, 2026. The vulnerability carries a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, CoreShop Advisory).

The root cause is improper neutralization of user-supplied input in SQL commands (CWE-89, CWE-564): the store parameter retrieved from the HTTP request via ParameterBag is directly concatenated into a raw SQL query string in CoreShop/src/CoreShop/Bundle/CoreBundle/Report/SalesReport.php (line 107) without type casting or parameterization. This affects multiple report classes including SalesReport, ProductsReport, CarriersReport, CartsReport, CategoriesReport, ManufacturerReport, PaymentProvidersReport, AbandonedCartsReport, and VouchersReport. An attacker can manipulate the store GET parameter on the /admin/coreshop/report/get-data endpoint to inject SQL logic; while no direct output is returned, boolean (e.g., store=1 AND 1=1 vs. store=1 AND 2=1) and time-based (e.g., SLEEP(5)) techniques allow data extraction. The vulnerability was confirmed exploitable using sqlmap with tamper scripts (CoreShop Advisory, Patch Commit).

Exploitation is limited to confidentiality impact only, as the application's database account is read-only and non-DBA. A successful attacker can enumerate the database schema, extract all data accessible to the application's database user (including order data, customer information, and other eCommerce records), and fingerprint the backend environment (DBMS type, hostname, PHP version, available database names). No data modification, deletion, or service disruption is possible through this vulnerability (CoreShop Advisory, GitHub Advisory).

A proof-of-concept exploit is documented in the security advisory itself, including specific sqlmap commands and payloads that successfully confirmed boolean-based and time-based blind SQL injection. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid administrator-level credentials, significantly limiting the attack surface. The EPSS score is approximately 0.024% (0.000240), placing it in the 1st percentile for exploitation likelihood (CoreShop Advisory, GitHub Advisory).

1. Authenticate as Administrator: Obtain valid administrator credentials for the CoreShop admin panel (version ≤ 4.1.7) and log in.
2. Identify the vulnerable endpoint: Navigate to or craft a request to /admin/coreshop/report/get-data?report=products&from=<timestamp>&to=<timestamp>&store=1&objectType=all&orderState=[]&page=1&start=0&limit=50.
3. Confirm boolean-based injection: Send a request with store=1 AND 1=1 and observe that normal data is returned. Then send store=1 AND 2=1 and observe an empty dataset — confirming the store parameter influences SQL query logic.
4. Confirm time-based injection: Send a request with store=1 AND (SELECT 6265 FROM (SELECT(SLEEP(5)))KORX) and observe a ~5-second response delay, confirming time-based blind SQL injection.
5. Automate extraction with sqlmap: Run sqlmap against a captured request file: python sqlmap.py -r test.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --proxy http://127.0.0.1:8080 -p store. sqlmap will fingerprint the DBMS (MySQL ≥ 5.0.12), enumerate available databases, and extract table contents using boolean and time-based inference.
6. Extract sensitive data: Use sqlmap's --dump or --tables options to enumerate and extract database contents accessible to the read-only application database account (CoreShop Advisory).

• Network: Unusual GET requests to /admin/coreshop/report/get-data with the store parameter containing SQL keywords such as AND, SLEEP, SELECT, FROM, or encoded equivalents; repeated requests with slight variations in the store parameter value suggesting automated enumeration.
• Logs: Web server access logs showing requests to the report endpoint with non-numeric or complex store parameter values (e.g., store=1+AND+1%3D1, store=1+AND+(SELECT+...)); abnormally slow response times on report endpoints (indicative of time-based injection with SLEEP()).
• Application Logs: PHP or application error logs showing unexpected SQL query behavior or database errors triggered by malformed store parameter values.
• Database Logs: MySQL general query log entries showing queries with injected AND conditions, SLEEP() calls, or subqueries originating from the CoreShop application user (CoreShop Advisory).

Upgrade CoreShop to version 4.1.8 or later, which resolves the vulnerability by replacing direct string concatenation of the store parameter with named parameter binding (:storeId) across all affected report classes, consistent with Doctrine DBAL best practices. The fix was merged via pull request #2936 and is available in commit 59e84fe. As a temporary workaround if immediate upgrade is not possible, enforce strict integer casting on the store parameter ((int) $storeId) and restrict administrative panel access to trusted IP ranges via network-level controls. Additionally, monitor database query logs for anomalous patterns indicative of SQL injection attempts (Patch Commit, GitHub Advisory).

The vulnerability was reported by security researcher PlyNatwara and analyzed by bypazs, with the advisory published by CoreShop maintainer dpfaffenbauer on January 7, 2026. The issue received routine coverage from automated vulnerability tracking services including Vulners, CIRCL, and INCIBE-CERT. No significant broader media coverage or notable community debate has been identified, consistent with the moderate severity rating and the requirement for administrator-level access to exploit (CoreShop Advisory).