CoreUnion - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/coreunion/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 15:31:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCoreShop: Unauthenticated SQL injection in GetGoodsPageList (CVE-2026-119656)https://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli-f92aa1d1/Fri, 30 Oct 2026 15:31:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-coreshop-sqli-f92aa1d1/CoreShop versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint, allowing attackers to extract sensitive data via blind SQL injection techniques.CoreShop by CoreUnion through 1.5.5 is susceptible to an unauthenticated SQL injection vulnerability. The flaw exists in the 'api/Agent/GetGoodsPageList' endpoint, where the 'order' parameter is insecurely concatenated into an 'ORDER BY' clause. This allows unauthenticated attackers to manipulate the query structure, bypassing field validation implemented in SqlSugar.

Impact

Attackers can leverage boolean-based or time-based blind SQL injection to extract sensitive information from the application database, including member account credentials and order history details.

Recommendation

  • Upgrade CoreShop to a version beyond 1.5.5 immediately upon release of a vendor patch.
  • Inspect web server access logs for anomalous requests to 'api/Agent/GetGoodsPageList' containing special characters commonly associated with SQL injection (e.g., semicolons, dashes, or time-delay functions like 'SLEEP' or 'WAITFOR DELAY').
  • Apply WAF rules to block or sanitize 'order' parameters directed at the 'api/Agent/GetGoodsPageList' endpoint that contain non-alphanumeric characters or SQL keywords.
]]>highadvisory