{"id":"CVE-2026-119656","kind":"vulnerability","aliases":["CVE-2026-119656"],"related":[],"title":"CoreShop: unauthenticated SQL injection leaks member accounts and orders","description":"CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.","summary":"CoreShop, an e-commerce platform by CoreUnion, has an unauthenticated SQL injection in the api/Agent/GetGoodsPageList endpoint through the order parameter. Anonymous attackers can extract member accounts and orders using blind boolean or time-based techniques.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coreshop","e-commerce","package","php","self-hosted"],"not_affected_if":["endpoint-not-exposed","version-above-1.5.5"],"how_to_check":"- Check the CoreShop version in use; versions through `1.5.5` are described as affected\n- Look for requests to `api/Agent/GetGoodsPageList` with an `order` parameter in web server logs","fix":"- Move to a CoreShop version later than `1.5.5`; the sources do not name the fixed version","status":"open","published_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:14+00:00","updated_at":"2026-10-30T15:33:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T15:33:14Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a CoreShop version later than `1.5.5`; the sources do not name the fixed version\n- unknown for other steps","reach":"internet","title":"CoreShop: unauthenticated SQL injection leaks member accounts and orders","impact":"high","summary":"CoreShop, an e-commerce platform by CoreUnion, has an unauthenticated SQL injection in the api/Agent/GetGoodsPageList endpoint through the order parameter. Anonymous attackers can extract member accounts and orders using blind boolean or time-based techniques.","audience":"businesses","category":"package","nicknames":[],"who_cares":["coreshop","e-commerce","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"member accounts and order data are extracted by anonymous attackers","analyst_note":"Confirm the fixed CoreShop version and whether the endpoint is enabled by default; the sources give only the NVD description.","how_to_check":"- Check the CoreShop version in use; versions through `1.5.5` are described as affected\n- Look for requests to `api/Agent/GetGoodsPageList` with an `order` parameter in web server logs\n- unknown for further checks","plain_action":"","needs_analyst":true,"not_affected_if":["version-above-1.5.5","endpoint-not-exposed"],"who_is_affected":"CoreShop installations at version 1.5.5 or earlier that expose the api/Agent/GetGoodsPageList endpoint to the internet are exposed, since no login is needed. Stores that run CoreShop on an internal network only, or that have restricted this endpoint, face less risk. The sources do not say whether default configurations expose the endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4160,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119656':12A,15A '-2026':11A,14A '1.5.5':66C 'account':7A,51B,101C 'anonym':46B,87C 'api/agent/getgoodspagelist':40B,75C 'append':81C 'attack':47B,88C 'base':60B,107C,111C 'blind':55B,112C 'boolean':56B,106C 'boolean-bas':105C 'bypass':93C 'check':97C 'claus':86C 'commerc':19B,29B 'contain':67C 'coreshop':1A,16B,25B,62C 'coreunion':32B,64C 'cve':10A,13A 'e':18B,28B 'e-commerc':17B,27B 'endpoint':41B,76C 'extract':49B,99C 'field':96C 'host':24B 'inject':4A,37B,71C,90C 'leak':5A 'member':6A,50B,100C 'order':9A,44B,53B,79C,84C,103C 'packag':20B 'paramet':45B,80C 'php':21B 'platform':30B 'self':23B 'self-host':22B 'sql':3A,36B,70C 'sqlsugar':94C 'subqueri':91C 'techniqu':61B,113C 'time':59B,110C 'time-bas':58B,109C 'unauthent':2A,35B,69C 'use':54B 'via':77C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"CoreShop installations at version 1.5.5 or earlier that expose the api/Agent/GetGoodsPageList endpoint to the internet are exposed, since no login is needed. Stores that run CoreShop on an internal network only, or that have restricted this endpoint, face less risk. The sources do not say whether default configurations expose the endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119656","severity":null,"published_at":"2026-10-30T15:16:49+00:00","modified_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}