{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/coreunion/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:coreunion:coreshop:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119656"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CoreShop (\u003c= 1.5.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CoreUnion"],"content_html":"\u003cp\u003eCoreShop by CoreUnion through 1.5.5 is susceptible to an unauthenticated SQL injection vulnerability. The flaw exists in the 'api/Agent/GetGoodsPageList' endpoint, where the 'order' parameter is insecurely concatenated into an 'ORDER BY' clause. This allows unauthenticated attackers to manipulate the query structure, bypassing field validation implemented in SqlSugar.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAttackers can leverage boolean-based or time-based blind SQL injection to extract sensitive information from the application database, including member account credentials and order history details.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade CoreShop to a version beyond 1.5.5 immediately upon release of a vendor patch.\u003c/li\u003e\n\u003cli\u003eInspect web server access logs for anomalous requests to 'api/Agent/GetGoodsPageList' containing special characters commonly associated with SQL injection (e.g., semicolons, dashes, or time-delay functions like 'SLEEP' or 'WAITFOR DELAY').\u003c/li\u003e\n\u003cli\u003eApply WAF rules to block or sanitize 'order' parameters directed at the 'api/Agent/GetGoodsPageList' endpoint that contain non-alphanumeric characters or SQL keywords.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T15:31:38Z","date_published":"2026-10-30T15:31:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli-f92aa1d1/","summary":"CoreShop versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint, allowing attackers to extract sensitive data via blind SQL injection techniques.","title":"CoreShop: Unauthenticated SQL injection in GetGoodsPageList (CVE-2026-119656)","url":"https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli-f92aa1d1/"}],"language":"en","title":"CraftedSignal Threat Feed - CoreUnion","version":"https://jsonfeed.org/version/1.1"}