{"id":"CVE-2026-119655","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-119655","summary":"CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers…","details":"CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.","published":"2026-10-30T15:16:49.300","modified":"2026-10-30T15:16:49.427","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4","label":"CoreUnion/CoreShop@0453011"},"references":[{"type":"WEB","url":"https://github.com/CoreUnion/CoreShop"},{"type":"WEB","url":"https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/BaseRepository.cs#L155-L165"},{"type":"WEB","url":"https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/GoodController.cs#L233-L241"},{"type":"WEB","url":"https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4"},{"type":"WEB","url":"https://github.com/CoreUnion/CoreShop/issues/20"},{"type":"WEB","url":"https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-30T15:16:49.427"}}