NVD security advisoryHigh
High advisory for CoreShop
CVE-2026-119655 · Reported 30 Oct 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
CoreShopAffected product
Advisory overview
CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.
Related references
- https://github.com/CoreUnion/CoreShop
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/BaseRepository.cs#L155-L165
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/GoodController.cs#L233-L241
- https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4
- https://github.com/CoreUnion/CoreShop/issues/20
- https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection
- https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist