{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acoreshopcoreshop/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:coreshop:coreshop:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119655"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CoreShop (\u003c= 1.5.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CoreShop"],"content_html":"\u003cp\u003eCoreShop versions through 1.5.5 are vulnerable to an unauthenticated SQL injection attack. The vulnerability exists within the 'api/Good/GetGoodsPageList' endpoint, where the 'order' parameter is not properly sanitized before being passed to an SQL ORDER BY clause. An attacker can leverage this flaw to bypass SqlSugar field checks, enabling boolean-based or time-based blind SQL injection to exfiltrate sensitive information, including member accounts and order details.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to perform unauthorized database queries, potentially leading to the full exfiltration of application data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to a patched version of CoreShop once available, as no fixed version is currently specified.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for suspicious patterns in the 'api/Good/GetGoodsPageList' endpoint, specifically looking for anomalous values in the 'order' parameter containing SQL syntax.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or use a Web Application Firewall (WAF) to block requests containing common SQL injection payloads in the 'order' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T15:31:28Z","date_published":"2026-10-30T15:31:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli/","summary":"CoreShop versions 1.5.5 and earlier contain an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint, allowing attackers to exfiltrate database contents via the order parameter.","title":"CoreShop: Unauthenticated SQL injection in api/Good/GetGoodsPageList (CVE-2026-119655)","url":"https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:coreshop:coreshop:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}