CVE-2026-119656
highCoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter…
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/CoreUnion/CoreShop disclosure@vulncheck.com
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/Good/CoreCmsGoods... disclosure@vulncheck.com
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/Agent... disclosure@vulncheck.com
- https://github.com/CoreUnion/CoreShop/commit/e40085b81d78ea55790305bc4a1592309b294048 disclosure@vulncheck.com
- https://github.com/CoreUnion/CoreShop/issues/20 disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parame... disclosure@vulncheck.com