CoreShop - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/coreshop/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 15:31:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCoreShop: Unauthenticated SQL injection in api/Good/GetGoodsPageList (CVE-2026-119655)https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli/Fri, 30 Oct 2026 15:31:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli/CoreShop versions 1.5.5 and earlier contain an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint, allowing attackers to exfiltrate database contents via the order parameter.CoreShop versions through 1.5.5 are vulnerable to an unauthenticated SQL injection attack. The vulnerability exists within the 'api/Good/GetGoodsPageList' endpoint, where the 'order' parameter is not properly sanitized before being passed to an SQL ORDER BY clause. An attacker can leverage this flaw to bypass SqlSugar field checks, enabling boolean-based or time-based blind SQL injection to exfiltrate sensitive information, including member accounts and order details.

Impact

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized database queries, potentially leading to the full exfiltration of application data.

Recommendation

  • Update to a patched version of CoreShop once available, as no fixed version is currently specified.
  • Monitor web application logs for suspicious patterns in the 'api/Good/GetGoodsPageList' endpoint, specifically looking for anomalous values in the 'order' parameter containing SQL syntax.
  • Implement strict input validation or use a Web Application Firewall (WAF) to block requests containing common SQL injection payloads in the 'order' parameter.
]]>highadvisory