Loading...

-

CVSS Score

-

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22242:

-

CVSS Score

-

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

CVE-2026-22242: CoreShop Reports SQL Injection | Miggo

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a blind SQL injection in the admin reports section of CoreShop. The store parameter, which is user-controlled, was not properly sanitized and was directly concatenated into SQL queries. This allowed an authenticated administrator to perform boolean-based or time-based blind SQL injection attacks to extract data from the database. The provided commit 59e84fec59d113952b6d28a9b30c6317f9e6e5dd fixes this vulnerability by replacing the direct concatenation of the $storeId with prepared statements in multiple report generation classes. The analysis of the patch reveals that any function responsible for generating a report and using the store parameter was vulnerable. The identified functions are the ones where the raw SQL query was built using the unsanitized store parameter.

Vulnerable functions

CoreShop\Bundle\CoreBundle\Report\AbandonedCartsReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/AbandonedCartsReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\CarriersReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/CarriersReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\CartsReport::getData

src/CoreShop/Bundle/CoreBundle/Report/CartsReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\CategoriesReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/CategoriesReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\CustomersReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/CustomersReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection. The fix applies parameter binding to prevent this.

CoreShop\Bundle\CoreBundle\Report\ManufacturerReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/ManufacturerReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\PaymentProvidersReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/PaymentProvidersReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\ProductsReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/ProductsReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\SalesReport::getData

src/CoreShop/Bundle/CoreBundle/Report/SalesReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.

CoreShop\Bundle\CoreBundle\Report\VouchersReport::getReportData

src/CoreShop/Bundle/CoreBundle/Report/VouchersReport.php

The 'store' parameter from the request is directly concatenated into the SQL query, allowing for SQL injection.