Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
SQL Injection in CustomerTransformerController Summary An error-based SQL Injection vulnerability was identified in the CustomerTransformerController within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. This issue is classified as MEDIUM severity, as it allows SQL execution in an authenticated admin context. --- Details The vulnerability exists in the company name duplication check endpoint: Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization. Vulnerable file: Vulnerable code pattern: The $value parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter. Supplying a double quote (") causes a SQL syntax error, confirming that the input is executed in a SQL context. --- Exploitation Steps: Prerequisites - Admin panel access at…
Recommended action: Upgrade to 4.1.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected Version(s) - CoreShop 4.1.2 Demo (tested) Demo | CoreShop - Earlier versions may also be affected if the same code path exists Summary A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. Details The vulnerability occurs due to unsanitized user input being concatenated into a SQL query without proper parameterization. An attacker with administrative access can manipulate the affected parameter to influence the backend SQL query logic. Although no direct query output is returned, boolean and time-based inference techniques allow an attacker to extract data from the database. Impact Vulnerability Type: Blind SQL Injection Impact: Confidentiality only An attacker…
Recommended action: Upgrade to 4.1.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.