Unauthenticated SQL Injection in CoreShop by CoreUnion

CVE-2026-119656

What is CVE-2026-119656?

CoreShop, developed by CoreUnion, is affected by an unauthenticated SQL injection vulnerability located in the api/Agent/GetGoodsPageList endpoint. This flaw allows an attacker to manipulate the order parameter in an ORDER BY clause. By exploiting this vulnerability, unauthorized users may execute subqueries that evade SqlSugar's field checks. Consequently, they can gain access to sensitive member accounts and order information through techniques like boolean-based or time-based blind SQL injection. Organizations using affected versions must implement necessary security measures to mitigate the risk of exploitation.

References