CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible. This issue has been patched in version 4.1.8.

Affected: Packagist: coreshop/core-shop

### Affected Version(s)

- CoreShop 4.1.2 Demo (tested) [Demo | CoreShop](https://docs.coreshop.com/CoreShop/Getting_Started/Demo/index.html) - Earlier versions may also be affected if the same code path exists

### Summary

A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

### Details

The vulnerability occurs due to unsanitized user input being concatenated into a SQL query without proper parameterization.

An attacker with administrative access can manipulate the affected parameter to influence the backend SQL query logic. Although no direct query output is returned, boolean and time-based inference techniques allow an attacker to extract data from the database.

### Impact

**Vulnerability Type:** Blind SQL Injection

**Impact:** Confidentiality only

An attacker can:

- Enumerate database schema - Extract all data accessible to the application’s database user

**CVSS v3.1 (Base Score: 4.9 – Medium)**

``` CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N ```

### Steps to Reproduce:

<img width="1010" height="372" alt="1" src="https://github.com/user-attachments/assets/312422c8-f3ea-4332-8c14-59aed737da6a" />

1. **Send a Normal Request:** - Request the…