CVE-2026-119656— CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

Quick assessment

Affected

CoreUnion CoreShop

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CoreUnion 开发的 CoreShop（1.5.5 及以下版本）在接口中存在一个无需认证的 SQL 注入漏洞。该漏洞源于参数被直接拼接到 SQL 语句的子句中。匿名攻击者可利用此漏洞注入子查询，绕过 SqlSugar 框架的字段校验机制，进而通过布尔盲注或时间盲注技术窃取会员账户信息及订单数据。

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

Source: CVE Program / CVE List V5

Vulnerability Description

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
CoreUnion	CoreShop	0 ~ 1.5.5	-

II. Public POCs for CVE-2026-119656

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119656

请登录查看更多情报信息。

Vendor Pages for CVE-2026-119656 (1)

🔗 GitHub - CoreUnion/CoreShop: 基于 Asp.Net Core 9.0、Uni-App开发，支持可视化布局的小程序商城系统，前后端分离，支持分布式部署，跨平台运行，拥有分销、代理、团购、拼团、秒杀、直播、优惠券、自定义表单等众多营销功能，拥有完整SKU、下单、售后、物流流程。支持一套代码编译发布微信小程序版、H5版、Android版、iOS版、支付宝小程序版、字节跳动小程序版、QQ小程序版等共10个平台。 · GitHub Read full article product

Other References for CVE-2026-119656 (6)

https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/Good/CoreCmsGoodsRepository.cs#L1622-L1730 technical-description
https://github.com/CoreUnion/CoreShop/issues/20 issue-tracking
https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection third-party-advisory
https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/AgentController.cs#L164-L170 technical-description
https://github.com/CoreUnion/CoreShop/commit/e40085b81d78ea55790305bc4a1592309b294048 patch
https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-agent-getgoodspagelist third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119656

IV. Related Vulnerabilities

Same product: CoreShop

Same vendor: CoreUnion

Same weakness: CWE-89