Unauthenticated SQL Injection in CoreShop Product by CoreUnion
CVE-2026-119655

8.7HIGH

Key Information:

Vendor

Coreunion

Status
Coreshop
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119655?

CoreShop versions up to 1.5.5 are susceptible to an unauthenticated SQL injection vulnerability found in the api/Good/GetGoodsPageList endpoint. This vulnerability arises from the unvalidated 'order' parameter used in the ORDER BY clause, allowing attackers to craft malicious subqueries that can bypass SqlSugar's field validation. Exploitation of this vulnerability can lead to the extraction of sensitive information, including member accounts and order details, via boolean-based or time-based blind SQL injection techniques.

Affected Version(s)

CoreShop 0 <= 1.5.5

References

https://github.com/CoreUnion/CoreShop/issues/20
issue-tracking
https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5...
patch
https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
jianweie
.