Skip to content
Threat Feed
Subscribe
high advisory

CoreShop: Unauthenticated SQL injection in GetGoodsPageList (CVE-2026-119656)

CoreShop versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint, allowing attackers to extract sensitive data via blind SQL injection techniques.

CVE search metadata

CVE search record: CVE-2026-119656. Severity: high. CVSS: 7.5. KEV: no. Product: CoreShop (<= 1.5.5). Brief: CoreShop: Unauthenticated SQL injection in GetGoodsPageList (CVE-2026-119656). Brief link: https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli-f92aa1d1/

Triage facts

Revision 1
Applicability
CoreShop (<= 1.5.5)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 30, 15:31 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

CoreShop by CoreUnion through 1.5.5 is susceptible to an unauthenticated SQL injection vulnerability. The flaw exists in the 'api/Agent/GetGoodsPageList' endpoint, where the 'order' parameter is insecurely concatenated into an 'ORDER BY' clause. This allows unauthenticated attackers to manipulate the query structure, bypassing field validation implemented in SqlSugar.

Impact

Attackers can leverage boolean-based or time-based blind SQL injection to extract sensitive information from the application database, including member account credentials and order history details.

Recommendation

  • Upgrade CoreShop to a version beyond 1.5.5 immediately upon release of a vendor patch.
  • Inspect web server access logs for anomalous requests to 'api/Agent/GetGoodsPageList' containing special characters commonly associated with SQL injection (e.g., semicolons, dashes, or time-delay functions like 'SLEEP' or 'WAITFOR DELAY').
  • Apply WAF rules to block or sanitize 'order' parameters directed at the 'api/Agent/GetGoodsPageList' endpoint that contain non-alphanumeric characters or SQL keywords.

Immediate actions

Deploy the provided Sigma rule to web application firewalls or WAF-enabled SIEM pipelines

Detection Engineering 48h

Threat Hunt

Search web access logs for high-frequency or anomalous characters in the order parameter of the specified endpoint

T1190 medium medium confidence hunt now

Data: Web access logs (cs-uri-query)

Mitigations

Upgrade CoreShop to a patched version once released by CoreUnion

immediate IT Operations

CVE-2026-119656

Detection coverage 1

Detects CVE-2026-119656 Exploitation - Blind SQL Injection via GetGoodsPageList

high

Detects attempts to exploit CVE-2026-119656 by identifying SQL injection characters and keywords in the order parameter of the api/Agent/GetGoodsPageList endpoint

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →