---
id: "CVE-2026-119655"
kind: "vulnerability"
aliases: ["CVE-2026-119655"]
title: "CoreShop: unauthenticated SQL injection in goods list endpoint exposes accounts"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "CoreShop (CoreUnion)", "fixed": [], "affected": "<= 1.5.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["coreshop", "coreunion", "dotnet", "e-commerce", "internet-facing", "package", "sql-injection", "sql-server", "sqlsugar"]
not_affected_if: ["not-internet-facing", "pimcore-coreshop", "version-above-1.5.5"]
published_at: "2026-10-30T15:16:49+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:35:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119655", "first_seen_at": "2026-10-30T15:31:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T15:35:13+00:00"}]
---

# CoreShop: unauthenticated SQL injection in goods list endpoint exposes accounts

CoreShop, an e-commerce platform, does not validate the order parameter in its goods list API, which is appended to an ORDER BY clause. An unauthenticated attacker can inject subqueries and use blind techniques to extract member accounts and orders from the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CoreShop (CoreUnion) affected <= 1.5.5 fixed ?

## How to check

- Check whether you run CoreUnion/CoreShop (ASP.NET Core mall system, CoreCms.Net.* projects) at v1.5.5 or earlier; the Pimcore CoreShop is a different product.
- Look in CoreCms.Net.Web.WebApi/Controllers/GoodController.cs and AgentController.cs for 'orderBy += "," + entity.order' passed to QueryPageAsync.
- Check that CoreCmsGoodsServices.cs contains commit 0453011.
- Test only your own systems: POST /api/Good/GetGoodsPageList with order '(SELECT 1)'. If it returns 200 instead of an error, raw SQL is reaching ORDER BY.

## Fix

No released fixed version. Upstream commit 0453011fe2a5abc4c202894ed1d9e87b2accc9e4 on CoreUnion/CoreShop master (2026-10-22) changes CoreCmsGoodsServices.QueryPageForLinqAsync to call _dal.QueryPageForLinqAsync, so order goes through a whitelist. Build from a revision containing it, or block/validate the order field at a reverse proxy or WAF until a release exists. Check whether api/Agent/GetGoodsPageList is also covered.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119655
- 2026-10-30T15:35:13+00:00 analyst — Product is CoreUnion/CoreShop (.NET, SqlSugar), not the Pimcore CoreShop. Advisory is VulnCheck; researcher writeup (static review, not runtime-proven) shows api/Good/GetGoodsPageList and api/Agent/GetGoodsPageList concatenate the order field into a raw ORDER BY with no auth. Upstream commit 0453011 (2026-10-22) routes the call via QueryPageForLinqAsync, which applies an order whitelist; it changes only the Good service, so the Agent endpoint may still be open (unverified). No GitHub release or tag past 1.5.5, so there is no fixed version number. Not exploited, no public PoC code (writeup has illustrative payloads). Pimcore CoreShop advisories are unrelated.

## Documents

- [advisory] VulnCheck: CoreShop through 1.5.5 SQL Injection via order Parameter https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist
- [describes] hieuPenguinnn: CoreShop unauthenticated SQLi via goods-list sort parameter https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection
- [fix] CoreUnion/CoreShop commit 0453011: route goods list through QueryPageForLinqAsync (order whitelist) https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4

## From the sources

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_