CVE-2026-23959: 
PHP vulnerability analysis and mitigation

CVE-2026-23959 is an error-based SQL Injection vulnerability in CoreShop, a Pimcore-enhanced eCommerce solution, affecting all versions prior to 4.1.9 of the coreshop/core-shop Composer package. The flaw resides in the CustomerTransformerController within the CoreShop admin panel, where user-supplied input is improperly interpolated into a SQL query without parameterization. It was published on January 20, 2026, and patched in version 4.1.9 released the same day. The vulnerability carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is improper neutralization of user-controlled input in a SQL condition, classified as CWE-564 (SQL Injection: Hibernate). The vulnerable code in src/CoreShop/Bundle/CoreBundle/Controller/CustomerTransformerController.php uses sprintf('name LIKE "%%%s%%"', (string) $value) to build a SQL condition, directly embedding the $value query parameter without escaping or prepared statement binding. An attacker with admin panel access can supply a double-quote character (") to the endpoint GET /admin/coreshop/customer-company-modifier/duplication-name-check?value= to trigger a SQL syntax error, confirming the injection point and enabling error-based or blind SQL data extraction. The fix replaces the vulnerable pattern with a parameterized query: $list->addConditionParam('name LIKE ?', '%' . $value . '%') (Github Advisory, Fix Commit).

Successful exploitation allows an authenticated admin-level attacker to disclose database error messages, enumerate the database schema, and potentially extract sensitive data via error-based or blind SQL injection techniques. The impact is limited to confidentiality — integrity and availability of the system are not directly affected — but database contents such as customer records, order data, and credentials stored in the Pimcore/CoreShop database could be exposed. Because exploitation requires high privileges (admin panel access), the practical risk is constrained to insider threats or scenarios where admin credentials have been compromised (Github Advisory).

No public exploit kit or weaponized exploit has been reported, but the GitHub security advisory includes detailed exploitation steps and confirms that sqlmap can be used against the vulnerable endpoint. The EPSS score is approximately 0.015% (4th percentile), indicating a low near-term exploitation probability. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Obtain Admin Credentials: Acquire valid CoreShop/Pimcore admin credentials (e.g., through credential theft, phishing, or default credentials such as admin/coreshop on unmodified demo instances).
2. Retrieve CSRF Token: Send a GET request to /admin/login/csrf-token and extract the csrfToken value from the response.
3. Authenticate: Submit a POST request to /admin/login/login with username, password, and csrfToken parameters, storing the resulting session cookie.
4. Confirm Injection Point: Send GET /admin/coreshop/customer-company-modifier/duplication-name-check?value=%22 (URL-encoded double quote). A normal response returns {"success":true,"message":null,"list":[]}, while the injection triggers an HTTP 500 error, confirming unsanitized input reaches the SQL query.
5. Extract Data with sqlmap: Use sqlmap against the vulnerable endpoint with the authenticated session: python sqlmap.py -r sql.txt --random-agent --batch --force-ssl --ignore-code=403,404 --no-cast --tamper=between,randomcase,space2comment --dbms=mysql -p value --level=5 --risk=3 --current-db to enumerate the database and extract data via error-based or blind SQL injection techniques (Github Advisory).

• Network: Unusual GET requests to /admin/coreshop/customer-company-modifier/duplication-name-check with special characters (e.g., %22, ', --) or SQL keywords in the value parameter; repeated requests to this endpoint from a single IP in a short timeframe.
• Logs: Web server access logs showing HTTP 500 responses for requests to the duplication-name-check endpoint; database error messages referencing SQL syntax errors in application logs.
• Logs: Evidence of sqlmap user-agent strings (e.g., sqlmap/1.x) or tamper-script-modified request patterns in access logs.
• Application: Unexpected or anomalous admin panel login events followed immediately by requests to the vulnerable endpoint (Github Advisory).

The vendor released CoreShop version 4.1.9 on January 20, 2026, which fixes the injection by replacing the vulnerable sprintf-based SQL construction with a parameterized query. Administrators should upgrade the coreshop/core-shop Composer package to version 4.1.9 or later immediately. As a defense-in-depth measure, input validation (e.g., enforcing string type and maximum length of 255 characters) and graceful error handling (returning controlled JSON error responses instead of raw 500 pages) are also recommended (Github Advisory, Release 4.1.9).