CVE-2026-119655: CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

Published Oct 30, 2026

Updated

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

Event History

Oct 30, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any remote, unauthenticated attacker who can reach the api/Good/GetGoodsPageList endpoint can attempt exploitation. No credentials or user interaction are required.

What data could an attacker obtain?

The described blind SQL injection techniques can be used to extract member account and order data. The available information indicates confidentiality impact, not data modification or service disruption.

How can I determine whether my deployment is affected?

Deployments running CoreShop 1.5.5 or earlier should be treated as affected if the GetGoodsPageList API endpoint is reachable. The vulnerable code path accepts the order parameter and appends it to an ORDER BY clause without validation.

What should be done if patching cannot happen immediately?

Restrict unauthenticated access to the api/Good/GetGoodsPageList endpoint, such as through network controls or an API gateway, until the vulnerable implementation can be remediated. Blocking or validating unexpected order parameter values can reduce exposure.

CVE-2026-119655: CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

Event History

Frequently Asked Questions

Who can exploit this issue?

What data could an attacker obtain?

How can I determine whether my deployment is affected?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data could an attacker obtain?

How can I determine whether my deployment is affected?

What should be done if patching cannot happen immediately?