SQL injection in CoreShop order parameter lets attackers extract data
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
CoreShop by CoreUnion through 1.5.5 contains an SQL injection flaw in the api/Agent/GetGoodsPageList endpoint, where the order parameter is appended to an ORDER BY clause without proper neutralization (CWE-89). An unauthenticated remote attacker can inject subqueries that bypass SqlSugar's field check and extract member accounts and orders through blind techniques.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for CoreShop.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119656
- 2026-10-30 Alias added: GHSA-c5ch-p933-jxhp
- 2026-11-01 Priority changed: MEDIUM → LOW
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → HIGH
References
Other 4
- https://github.com/CoreUnion/CoreShop/issues/20
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/AgentController.cs#L164-L170
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/Good/CoreCmsGoodsRepository.cs#L1622-L1730
- https://github.com/CoreUnion/CoreShop
More CoreUnion vulnerabilities
- TI-2026-83129 SQL injection in CoreShop GetGoodsPageList via order parameter CVSS 4.0HIGH 8.7
- TI-2026-70676 Authorization bypass in CoreShop lets customers act on others' orders CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-119656 · CVE Program
- CVE-2026-119656 · NVD
- FIRST EPSS
- GHSA-c5ch-p933-jxhp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences