CVE-2026-119656: CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any deployment running an affected CoreShop version with the api/Agent/GetGoodsPageList endpoint reachable by an anonymous network attacker is exposed. No authentication or user interaction is required.
What does an attacker need to exploit this issue?
An attacker only needs to send crafted requests to the endpoint and control the order parameter. The injection occurs when that value is appended to an ORDER BY clause, allowing subqueries that bypass SqlSugar's field check.
What data could be obtained?
The described techniques can extract member account and order data. Extraction is performed through boolean-based or time-based blind SQL injection.
How can defenders identify potentially affected systems?
Check whether the deployment uses CoreShop through version 1.5.5 and exposes api/Agent/GetGoodsPageList. Review requests to that endpoint for unusual order parameter values, especially values containing SQL expressions or subquery-like syntax.