CoreShop (<= 1.5.5)

CoreShop versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint, allowing attackers to extract sensitive data via blind SQL injection techniques.

CoreShop versions 1.5.5 and earlier contain an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint, allowing attackers to exfiltrate database contents via the order parameter.