{"id":"CVE-2026-119656","title":"CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList","summary":"CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"CoreUnion","product":"CoreShop","affected":["CoreShop <= 1.5.5"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-05T21:31:42.987611Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:31:58.813Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119656","references":[{"url":"https://github.com/CoreUnion/CoreShop/issues/20"},{"url":"https://github.com/CoreUnion/CoreShop/commit/e40085b81d78ea55790305bc4a1592309b294048"},{"url":"https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/AgentController.cs#L164-L170"},{"url":"https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/Good/CoreCmsGoodsRepository.cs#L1622-L1730"},{"url":"https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection"},{"url":"https://github.com/CoreUnion/CoreShop"},{"url":"https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-agent-getgoodspagelist","label":"VulnCheck Advisory: CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList"}],"tags":["cve.org","exploit-available"],"epss":0.00337,"epssPercentile":0.27271,"ingestedAt":"2026-11-05T16:07:30.296Z","slug":"CVE-2026-119656","body":"## Overview\n\nCoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.\n\n## Affected\n\n- `CoreShop <= 1.5.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":234881,"id":"CVE-2026-119656","ts":1793918466350,"field":"exploit_available","old":"false","new":"true"}]}