{"id":"CVE-2026-119655","title":"CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList","summary":"CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's fie…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"CoreUnion","product":"CoreShop","affected":["CoreShop <= 1.5.5"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-04T22:33:21.417150Z"},"published":"2026-10-30","updated":"2026-11-04","sourceUpdated":"2026-11-04T22:33:33.148Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119655","references":[{"url":"https://github.com/CoreUnion/CoreShop/issues/20"},{"url":"https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4"},{"url":"https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/GoodController.cs#L233-L241"},{"url":"https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/BaseRepository.cs#L155-L165"},{"url":"https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection"},{"url":"https://github.com/CoreUnion/CoreShop"},{"url":"https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist","label":"VulnCheck Advisory: CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList"}],"tags":["cve.org"],"epss":0.00337,"epssPercentile":0.27272,"ingestedAt":"2026-11-05T21:36:00.652Z","slug":"CVE-2026-119655","body":"## Overview\n\nCoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.\n\n## Affected\n\n- `CoreShop <= 1.5.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}