{"id":"CVE-2026-119655","kind":"vulnerability","aliases":["CVE-2026-119655"],"related":[],"title":"CoreShop: unauthenticated SQL injection in goods list endpoint exposes accounts","description":"CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.","summary":"CoreShop, an e-commerce platform, does not validate the order parameter in its goods list API, which is appended to an ORDER BY clause. An unauthenticated attacker can inject subqueries and use blind techniques to extract member accounts and orders from the database.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CoreShop (CoreUnion)","fixed":[],"affected":"<= 1.5.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["coreshop","coreunion","dotnet","e-commerce","internet-facing","package","sql-injection","sql-server","sqlsugar"],"not_affected_if":["not-internet-facing","pimcore-coreshop","version-above-1.5.5"],"how_to_check":"- Check whether you run CoreUnion/CoreShop (ASP.NET Core mall system, CoreCms.Net.* projects) at v1.5.5 or earlier; the Pimcore CoreShop is a different product.\n- Look in CoreCms.Net.Web.WebApi/Controllers/GoodController.cs and AgentController.cs for 'orderBy += \",\" + entity.order' passed to QueryPageAsync.\n- Check that CoreCmsGoodsServices.cs contains commit 0453011.\n- Test only your own systems: POST /api/Good/GetGoodsPageList with order '(SELECT 1)'. If it returns 200 instead of an error, raw SQL is reaching ORDER BY.","fix":"No released fixed version. Upstream commit 0453011fe2a5abc4c202894ed1d9e87b2accc9e4 on CoreUnion/CoreShop master (2026-10-22) changes CoreCmsGoodsServices.QueryPageForLinqAsync to call _dal.QueryPageForLinqAsync, so order goes through a whitelist. Build from a revision containing it, or block/validate the order field at a reverse proxy or WAF until a release exists. Check whether api/Agent/GetGoodsPageList is also covered.","status":"open","published_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:15+00:00","updated_at":"2026-10-30T15:35:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T15:33:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CoreShop: unauthenticated SQL injection in goods list endpoint exposes accounts","impact":"high","summary":"CoreShop, an e-commerce platform, does not validate the order parameter in its goods list API, which is appended to an ORDER BY clause. An unauthenticated attacker can inject subqueries and use blind techniques to extract member accounts and orders from the database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["coreshop","e-commerce","sql-injection","internet-facing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Member accounts and orders readable from the database by unauthenticated attackers","analyst_note":"Confirm the fixed version and whether an upstream patch exists; the NVD entry alone does not state a fix.","how_to_check":"- Check the CoreShop version in use; the flaw is described for versions through `1.5.5`.\n- Look for the `api/Good/GetGoodsPageList` endpoint in the deployed application and whether it is reachable from the internet.\n- Review the source for the unvalidated `order` parameter passed to ORDER BY.","plain_action":"","needs_analyst":true,"not_affected_if":["version-above-1.5.5"],"who_is_affected":"CoreShop installations at version 1.5.5 or earlier that expose the goods list API endpoint. The sources describe the endpoint as unauthenticated, so any internet-reachable instance is in scope; the sources do not say whether the flaw is limited to a particular configuration. Teams running a different e-commerce platform or a patched version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4158,"output_tokens":610,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether an upstream patch exists; the NVD entry alone does not state a fix.","search":"'-119655':13A,16A '-2026':12A,15A '1.5.5':82C 'account':10A,74B,126C 'api':52B 'api/good/getgoodspagelist':91C 'append':55B,98C 'attack':63B,102C 'base':116C,120C 'blind':69B,121C 'boolean':115C 'boolean-bas':114C 'bypass':107C 'check':111C 'claus':60B 'commerc':24B,40B 'contain':83C 'coreshop':1A,17A,19B,36B,80C 'coreunion':18A,20B 'cve':11A,14A 'databas':79B 'dotnet':21B 'e':23B,39B 'e-commerc':22B,38B 'endpoint':8A,92C 'expos':9A 'extract':72B,124C 'face':27B 'field':110C 'good':6A,50B 'inject':4A,31B,65B,87C,104C 'internet':26B 'internet-fac':25B 'list':7A,51B 'member':73B,125C 'order':46B,58B,76B,96C,100C,128C 'packag':28B 'paramet':47B,97C 'platform':41B 'server':34B 'sql':3A,30B,33B,86C 'sql-inject':29B 'sql-server':32B 'sqlsugar':35B,108C 'subqueri':66B,105C 'techniqu':70B,122C 'time':119C 'time-bas':118C 'unauthent':2A,62B,85C 'unvalid':95C 'use':68B,113C 'valid':44B 'via':93C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the CoreUnion CoreShop .NET mall system (v1.5.5 or earlier) with the WebApi reachable from the internet. No login is needed, and the default database, SQL Server, allows subqueries in ORDER BY, so an attacker can read the member, order and address tables. Pimcore CoreShop users, and installs with the WebApi not exposed to untrusted networks, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-30T15:35:13Z","by":"analyst","doc":"https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4","run_id":1166},"who_affected":{"at":"2026-10-30T15:35:13Z","by":"analyst","doc":"https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4","run_id":1166}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119655","severity":null,"published_at":"2026-10-30T15:16:49+00:00","modified_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119655:1166","url":null,"severity":null,"published_at":"2026-10-30T15:35:13+00:00","modified_at":"2026-10-30T15:35:13+00:00","first_seen_at":"2026-10-30T15:35:13+00:00","fetched_at":"2026-10-30T15:35:13+00:00","note":"Product is CoreUnion/CoreShop (.NET, SqlSugar), not the Pimcore CoreShop. Advisory is VulnCheck; researcher writeup (static review, not runtime-proven) shows api/Good/GetGoodsPageList and api/Agent/GetGoodsPageList concatenate the order field into a raw ORDER BY with no auth. Upstream commit 0453011 (2026-10-22) routes the call via QueryPageForLinqAsync, which applies an order whitelist; it changes only the Good service, so the Agent endpoint may still be open (unverified). No GitHub release or tag past 1.5.5, so there is no fixed version number. Not exploited, no public PoC code (writeup has illustrative payloads). Pimcore CoreShop advisories are unrelated."}],"documents":[{"id":24333,"url":"https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist","title":"VulnCheck: CoreShop through 1.5.5 SQL Injection via order Parameter","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":24334,"url":"https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4","title":"CoreUnion/CoreShop commit 0453011: route goods list through QueryPageForLinqAsync (order whitelist)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":24335,"url":"https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection","title":"hieuPenguinnn: CoreShop unauthenticated SQLi via goods-list sort parameter","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}