CVE-2026-119655 in CoreShop
Summary
by MITRE • 10/30/2026
CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
CoreShop versions through 1.5.5 are susceptible to a critical unauthenticated SQL injection vulnerability located within the api/Good/GetGoodsPageList endpoint. This flaw stems from the improper validation of user-supplied input specifically associated with the order parameter, which is directly appended to an ORDER BY clause in backend database queries. Unlike standard SQL injection vectors that target data retrieval via WHERE clauses, this vulnerability exploits the structural execution path of sorting operations. The application fails to sanitize or strictly validate the values provided for ordering results, allowing attackers to inject arbitrary SQL syntax into the query structure itself rather than just its conditional filters.
The technical mechanism behind this exploitation relies on bypassing SqlSugar's built-in field check mechanisms. While many ORM frameworks attempt to mitigate injection by validating column names against a whitelist of allowed fields, CoreShop’s implementation allows for circumvention through sophisticated payload construction. Attackers can inject subqueries that manipulate the database engine into executing unintended commands or revealing internal data structures. By leveraging boolean-based blind techniques, an attacker can deduce information about the database schema and content based on true or false responses from the application. Alternatively, time-based blind injection methods allow for extraction by inducing measurable delays in query execution when specific conditions are met, enabling the retrieval of sensitive data even without direct output visibility.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Any external actor with network access to the CoreShop instance can exploit this flaw without needing valid credentials or prior authentication. The primary consequence is the unauthorized extraction of highly sensitive information, including member account details and order history. This data breach compromises user privacy and exposes financial transaction records, potentially leading to identity theft, fraud, or further lateral movement within an organization’s infrastructure if such data correlates with other systems. The ability to bypass security controls inherent in the SqlSugar library underscores a significant gap in input validation logic for dynamic SQL construction.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and specifically targets the ORDER BY clause which is often overlooked by automated scanners that focus on WHERE clauses. In terms of adversary tactics, it maps to ATT&CK technique T1059 Command and Scripting Interpreter for executing injected payloads and T1078 Valid Accounts if exploitation leads to further access, though here it starts with unauthenticated access leading to data exfiltration which falls under T1213 Data from Information Repositories. The lack of authentication required makes this a high-severity issue that demands immediate attention as it allows for complete database compromise given sufficient time and effort by the attacker.
Mitigation strategies must prioritize strict input validation and parameterization where possible, although ORDER BY clauses present unique challenges because they often require dynamic column names rather than simple values. The most effective remediation is to implement a whitelist approach that restricts the order parameter to only predefined, safe column identifiers supported by the application logic. If dynamic sorting is required, developers should map user input to specific internal constants or indices before constructing the query string, ensuring no raw SQL syntax can be injected. Additionally, deploying a Web Application Firewall with rules specifically tuned for ORDER BY injection patterns can provide an interim layer of defense while code patches are developed and deployed. Regular security audits focusing on ORM usage and dynamic query construction practices are essential to prevent similar vulnerabilities in future updates.