EUVD-2026-114072
GHSA-c5ch-p933-jxhp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public api/Agent/GetGoodsPageList endpoint
-
DeliveryInject subquery via order parameter
-
ExploitBypass SqlSugar field-name check
-
ExecutionRun boolean/time-based blind SQLi
-
ImpactExfiltrate member accounts and orders
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of CoreShop (CoreUnion) through 1.5.5. The vulnerable code path is the standard api/Agent/GetGoodsPageList endpoint, which appends the request's 'order' parameter directly to the ORDER BY clause; the diff shows this was the shipped default behavior, not an opt-in setting. Exploitation requires no authentication (PR:N), no user interaction (UI:N), and no non-default feature flag. The only practical limiting factors are network reachability of the endpoint and the blind (boolean/time-based) nature of extraction, which slows but does not prevent data theft. |
| Impact | This is a genuine, actionable priority rather than an inflated CVSS number. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is internally consistent with the description: the api/Agent/GetGoodsPageList endpoint is reachable by anonymous attackers over the network with low complexity and no privileges (PR:N confirms unauthenticated), and the source-code diff corroborates the mechanism - a user-controlled 'order' value was concatenated into an ORDER BY clause. Impact is scoped to confidentiality (VC:H, with VI/VA:N), matching a blind read-only extraction of member accounts and orders. No EPSS score and no CISA KEV entry are present in the input, so there is no quantitative exploitation-probability signal and no evidence of active, widespread exploitation; the vuln.today Decision label is 'this_week', indicating prompt but not emergency remediation. A public technical write-up (hackmd) and the VulnCheck advisory are referenced, so working out exploitation is low-effort even though no confirmed weaponized exploit is listed. Net: high real-world severity for exposed instances (unauthenticated data theft), tempered by the product's limited deployment footprint and the absence of KEV/EPSS evidence of mass exploitation. |
| Exploit ScenarioDerived | An anonymous attacker sends a crafted POST request to the api/Agent/GetGoodsPageList endpoint with a malicious 'order' field that injects a subquery into the ORDER BY clause, bypassing SqlSugar's field-name check. Using boolean-based or time-based blind techniques, the attacker iteratively extracts member account credentials and order records from the database without any authentication. A public PoC reference (hackmd write-up) describes the technique, and given AV:N/AC:L, exploitation is straightforward against any internet-exposed instance through 1.5.5. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Unauthenticated SQL injection in CoreShop by CoreUnion through 1.5.5 lets remote attackers read member accounts and order records through the api/Agent/GetGoodsPageList endpoint. The controller appends the client-supplied 'order' value to a fixed ORDER BY string and hands it to SqlSugar, so crafted subqueries pass the ORM's field-name check and are executed by the database; extraction is blind (boolean- or time-based) because the results are never returned directly. No CISA KEV entry and no confirmed active exploitation are associated with this CVE at time of analysis, but a public technical writeup describing the injection exists and the vuln.today decision label is this_week, indicating remediation should be scheduled promptly.
RemediationAI
Apply the vendor fix in commit e40085b81d78ea55790305bc4a1592309b294048 (https://github.com/CoreUnion/CoreShop/commit/e40085b81d78ea55790305bc4a1592309b294048), which drops the orderBy parameter from ICoreCmsGoodsRepository.QueryAgentGoodsPageAsync, ICoreCmsGoodsServices and their implementations and hardcodes the sort to isRecommend/isHot descending in both query branches; the available data does not name a tagged release version containing the commit, so confirm the build you deploy includes it rather than assuming a version number. Because this is a source-level fix, sites running CoreShop through 1.5.5 without the commit remain exposed. If the patch cannot be deployed immediately, remove client influence over sorting at the edge: block or restrict POST api/Agent/GetGoodsPageList (the whole /api/Agent/ route group) to trusted networks or disable the agent goods listing until patched, accepting that agent storefront listing pages will break; alternatively add a WAF/reverse-proxy rule that rejects request bodies whose 'order' field contains SQL metacharacters such as parentheses, commas combined with keywords, or subquery markers, understanding that legitimate custom sort values would also be refused and that such filters are bypassable. Since the endpoint is unauthenticated by design, fronting it with authentication or rate limiting reduces bulk extraction speed but does not remove the injection. Advisory references: https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-agent-getgoodspagelist and https://github.com/CoreUnion/CoreShop/issues/20.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CoreShop is an ASP.NET Core e-commerce platform built on the SqlSugar ORM. In the shipped code, AgentController.GetGoodsPageList built the sort clause as orderBy = " isRecommend desc,isHot desc" and, when the request body's 'order' field was non-empty, concatenated "," + entity.order before passing the string through ICoreCmsGoodsServices.QueryAgentGoodsPageAsync down to the repository, which called SqlSugar's string-based .OrderBy(orderBy). This is a textbook CWE-89 root cause: privilege-bearing SQL syntax (the ORDER BY fragment) assembled from unvalidated user input rather than expressed as a typed expression tree. Because SqlSugar's string ORDER BY overload accepts SQL expressions rather than only column names, an attacker can place a subquery in the sort expression that survives the field check, enabling boolean-based or time-based blind inference against tables such as member accounts and orders - the injected results affect execution but not the returned response body, which is why extraction is indirect. The fix commit e40085b81d78ea55790305bc4a1592309b294048 removes the orderBy parameter from ICoreCmsGoodsRepository, ICoreCmsGoodsServices, CoreCmsGoodsServices and CoreCmsGoodsRepository, and replaces the string overload with typed .OrderBy(it => it.isRecommend, OrderByType.Desc).OrderBy(it => it.isHot, OrderByType.Desc) calls in both branches of QueryAgentGoodsPageAsync, eliminating client control over SQL syntax entirely.
Know when Coreshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network-reachable endpoint (AV:N/PR:N/UI:N/AC:L); blind SQLi yields read-only data disclosure, so C:H with I:N and A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.
Executive ViewAI
CoreShop by CoreUnion (through version 1.5.5) contains an unauthenticated SQL injection that could expose member account data and order records to remote attackers. Because no login is required and the affected endpoint is publicly reachable, any internet-facing storefront running this version is exposed, putting customer PII and order history-and the reputational and regulatory obligations tied to them-at risk. Leadership should prioritize remediation this week given a public technical writeup exists.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Blind SQL injection in CoreShop prior to version 4.1.8 allows authenticated administrators to extract sensitive database
Unauthenticated SQL injection in CoreShop through 1.5.5 allows remote attackers to read member accounts and order record
Any authenticated CoreShop customer can tamper with other customers' orders in versions through 1.5.5, because the Order
Missing authorization in CoreShop through 2026.2.2 lets authenticated Pimcore backend users who lack the relevant resour
Improper input sanitization in CoreShop's CustomerTransformerController prior to version 4.1.9 allows authenticated admi
Exploit-DB