CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. Version 4.1.9 fixes the issue.

Affected: Packagist: coreshop/core-shop

# SQL Injection in CustomerTransformerController

## Summary An **error-based SQL Injection vulnerability** was identified in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.

This issue is classified as **MEDIUM severity**, as it allows SQL execution in an authenticated admin context.

---

## Details The vulnerability exists in the company name duplication check endpoint:

``` /admin/coreshop/customer-company-modifier/duplication-name-check?value= ```

Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization.

**Vulnerable file:** ``` /app/repos/coreshop/src/CoreShop/Bundle/CustomerBundle/Controller/CustomerTransformerController.php ```

**Vulnerable code pattern:** ```php sprintf('name LIKE "%%%s%%"', (string) $value) ```

The `$value` parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter. Supplying a double quote (`"`) causes a SQL syntax error, confirming that the input is executed in a SQL context.

---

## Exploitation Steps:

### Prerequisites - Admin panel access at `https://demo4.coreshop.org/admin` - Default credentials: `admin / coreshop`

### Authenticate to admin panel ```bash # Get CSRF token curl -s 'https://demo4.coreshop.org/admin/login/csrf-token' | grep csrfToken

# Initializ…