Skip to content
Threat Feed
Subscribe
high advisory

CoreShop: Unauthenticated SQL injection in api/Good/GetGoodsPageList (CVE-2026-119655)

CoreShop versions 1.5.5 and earlier contain an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint, allowing attackers to exfiltrate database contents via the order parameter.

CVE search metadata

CVE search record: CVE-2026-119655. Severity: high. CVSS: 7.5. KEV: no. Product: CoreShop (<= 1.5.5). Brief: CoreShop: Unauthenticated SQL injection in api/Good/GetGoodsPageList (CVE-2026-119655). Brief link: https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli/

Triage facts

Revision 1
Applicability
CoreShop (<= 1.5.5)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 30, 15:31 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

CoreShop versions through 1.5.5 are vulnerable to an unauthenticated SQL injection attack. The vulnerability exists within the 'api/Good/GetGoodsPageList' endpoint, where the 'order' parameter is not properly sanitized before being passed to an SQL ORDER BY clause. An attacker can leverage this flaw to bypass SqlSugar field checks, enabling boolean-based or time-based blind SQL injection to exfiltrate sensitive information, including member accounts and order details.

Impact

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized database queries, potentially leading to the full exfiltration of application data.

Recommendation

  • Update to a patched version of CoreShop once available, as no fixed version is currently specified.
  • Monitor web application logs for suspicious patterns in the 'api/Good/GetGoodsPageList' endpoint, specifically looking for anomalous values in the 'order' parameter containing SQL syntax.
  • Implement strict input validation or use a Web Application Firewall (WAF) to block requests containing common SQL injection payloads in the 'order' parameter.

Immediate actions

Deploy Sigma rule to WAF or SIEM for api/Good/GetGoodsPageList monitoring

Detection Engineering 24h

Threat Hunt

Identify anomalies in request response time for the GetGoodsPageList endpoint which may indicate time-based blind SQLi

T1190 high medium confidence hunt now

Data: webserver response time latency

Mitigations

Apply WAF rules to sanitize or block requests with suspicious order parameter content

immediate IT Operations

CVE-2026-119655

Detection coverage 1

Detect CVE-2026-119655 Exploitation - SQL Injection in api/Good/GetGoodsPageList

high

Detects exploitation attempts targeting CVE-2026-119655 by monitoring for SQL keywords or subquery patterns in the order parameter of the GetGoodsPageList endpoint.

sigma tactics: exfiltration, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →