Coreshop
Monthly
Missing authorization in CoreShop through 2026.2.2 lets authenticated Pimcore backend users who lack the relevant resource grants enumerate restricted commerce configuration - payment providers, carriers, price rules, stores, and tax rules - including their IDs, names, and identifiers. The flaw lives in ResourceController::listAction, which omits the isGrantedOr403() check that sibling actions enforce, so any valid low-privileged backend account can reach the auto-generated list routes. Impact is confined to read-only information disclosure (no create/update/delete and no secret exposure indicated), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Any authenticated CoreShop customer can tamper with other customers' orders in versions through 1.5.5, because the OrderController's OrderConfirm and SendReship actions trust client-supplied order and reship identifiers instead of verifying that the caller owns the order. Omitting the data field in OrderConfirm allows the attacker to mark a victim's order as received, while supplying another customer's reshipId to SendReship overwrites that customer's return-tracking details - an integrity-only impact with no confidentiality or availability loss (assessed CVSS 3.1 5.3, PR:L). Exploitation requires an ordinary registered storefront account rather than elevated privileges, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV.
Improper input sanitization in CoreShop's CustomerTransformerController prior to version 4.1.9 allows authenticated administrators to inject SQL commands through the admin panel, enabling database error-based information disclosure. An attacker with high-privilege access can exploit this to extract sensitive data from the underlying database without modifying or deleting records. A patch is available in version 4.1.9 and later.
Blind SQL injection in CoreShop prior to version 4.1.8 allows authenticated administrators to extract sensitive database information through boolean-based or time-based attack techniques. The vulnerability is limited to information disclosure due to the application's read-only database permissions, preventing data modification or denial of service. Public exploit code exists for this vulnerability; administrators should upgrade to version 4.1.8 or later.
Missing authorization in CoreShop through 2026.2.2 lets authenticated Pimcore backend users who lack the relevant resource grants enumerate restricted commerce configuration - payment providers, carriers, price rules, stores, and tax rules - including their IDs, names, and identifiers. The flaw lives in ResourceController::listAction, which omits the isGrantedOr403() check that sibling actions enforce, so any valid low-privileged backend account can reach the auto-generated list routes. Impact is confined to read-only information disclosure (no create/update/delete and no secret exposure indicated), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Any authenticated CoreShop customer can tamper with other customers' orders in versions through 1.5.5, because the OrderController's OrderConfirm and SendReship actions trust client-supplied order and reship identifiers instead of verifying that the caller owns the order. Omitting the data field in OrderConfirm allows the attacker to mark a victim's order as received, while supplying another customer's reshipId to SendReship overwrites that customer's return-tracking details - an integrity-only impact with no confidentiality or availability loss (assessed CVSS 3.1 5.3, PR:L). Exploitation requires an ordinary registered storefront account rather than elevated privileges, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV.
Improper input sanitization in CoreShop's CustomerTransformerController prior to version 4.1.9 allows authenticated administrators to inject SQL commands through the admin panel, enabling database error-based information disclosure. An attacker with high-privilege access can exploit this to extract sensitive data from the underlying database without modifying or deleting records. A patch is available in version 4.1.9 and later.
Blind SQL injection in CoreShop prior to version 4.1.8 allows authenticated administrators to extract sensitive database information through boolean-based or time-based attack techniques. The vulnerability is limited to information disclosure due to the application's read-only database permissions, preventing data modification or denial of service. Public exploit code exists for this vulnerability; administrators should upgrade to version 4.1.8 or later.