CVE-2026-119655— CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

Quick assessment

Affected

CoreUnion CoreShop

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CoreShop 1.5.5 及更早版本在接口中存在一个无需认证的 SQL 注入漏洞。该漏洞源于对附加到子句中的参数缺乏验证。攻击者可注入子查询，绕过 SqlSugar 的字段检查机制，并利用基于布尔值或基于时间的盲注技术，窃取会员账户信息和订单数据。

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

Source: CVE Program / CVE List V5

Vulnerability Description

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
CoreUnion	CoreShop	0 ~ 1.5.5	-

II. Public POCs for CVE-2026-119655

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119655

请登录查看更多情报信息。

Vendor Pages for CVE-2026-119655 (1)

🔗 GitHub - CoreUnion/CoreShop: 基于 Asp.Net Core 9.0、Uni-App开发，支持可视化布局的小程序商城系统，前后端分离，支持分布式部署，跨平台运行，拥有分销、代理、团购、拼团、秒杀、直播、优惠券、自定义表单等众多营销功能，拥有完整SKU、下单、售后、物流流程。支持一套代码编译发布微信小程序版、H5版、Android版、iOS版、支付宝小程序版、字节跳动小程序版、QQ小程序版等共10个平台。 · GitHub Read full article product

Other References for CVE-2026-119655 (6)

https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/GoodController.cs#L233-L241 technical-description
https://github.com/CoreUnion/CoreShop/issues/20 issue-tracking
https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4 patch
https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection third-party-advisory
https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/BaseRepository.cs#L155-L165 technical-description
https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119655

IV. Related Vulnerabilities

Same product: CoreShop

Same vendor: CoreUnion

Same weakness: CWE-89