CVE-2026-119656 in CoreShop
Summary
by MITRE • 10/30/2026
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
CoreShop, a comprehensive e-commerce solution developed by CoreUnion, has been identified with a critical security flaw in versions up to 1.5.5. The vulnerability resides specifically within the api/Agent/GetGoodsPageList endpoint and is classified as an unauthenticated SQL injection. This means that any external actor on the network can exploit this weakness without needing valid credentials or prior authentication, significantly lowering the barrier for entry. The root cause of this issue lies in how the application handles input validation for the order parameter when constructing database queries. Specifically, user-supplied data is directly concatenated into an SQL ORDER BY clause without adequate sanitization or parameterization, allowing malicious payloads to alter the intended query structure.
The technical mechanism of exploitation involves injecting subqueries that are designed to bypass SqlSugar's built-in field check mechanisms. SqlSugar is a popular Object-Relational Mapping (ORM) framework for .NET applications, which typically provides some level of protection against SQL injection by validating column names and structures before executing queries. However, in this specific implementation, the validation logic can be circumvented through carefully crafted input that exploits how the ORM processes dynamic sorting parameters. By leveraging boolean-based or time-based blind techniques, an attacker can infer database contents bit-by-bit. Boolean-based attacks rely on observing differences in application responses based on true or false conditions within the injected query, while time-based attacks utilize delays to determine if a condition is met by measuring response times.
The operational impact of this vulnerability is severe due to its unauthenticated nature and the sensitivity of the data involved. Attackers can extract sensitive information such as member accounts, including usernames and potentially hashed passwords depending on database configuration, along with detailed order histories containing customer addresses, payment methods, and purchase records. This level of access compromises the confidentiality and integrity of user data, violating core principles of data protection regulations like GDPR or CCPA if applicable to the jurisdiction. Furthermore, successful exploitation could serve as a foothold for further lateral movement within the network, potentially leading to full system compromise if other vulnerabilities exist in adjacent services that rely on the same database credentials.
From an industry standards perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific technique of bypassing ORM protections highlights a common pitfall where developers assume framework-level security is sufficient without verifying input constraints at the application logic layer. In terms of attack tactics, this falls under MITRE ATT&CK Technique T1059, specifically command scripting or database query manipulation, and relates to Data from Information Repositories (T1213) as it involves extracting structured data from a database system. The unauthenticated aspect also maps to Initial Access techniques where attackers exploit public-facing applications with insufficient access controls.
To mitigate this vulnerability, immediate remediation is required by upgrading CoreShop to version 1.5.6 or later, which addresses the input validation logic for the order parameter. In cases where an upgrade is not immediately feasible, a temporary workaround involves implementing strict allow-listing of acceptable values for the ORDER BY clause on the server side rather than relying solely on ORM protections. Developers should ensure that only predefined column names are accepted and reject any input containing SQL keywords or special characters typically associated with injection attacks. Additionally, deploying a Web Application Firewall (WAF) with rules tuned to detect common SQL injection patterns can provide an additional layer of defense against exploitation attempts while permanent fixes are being tested and deployed. Regular security audits and static code analysis focused on ORM usage best practices will help prevent similar issues in future development cycles.