CoreShop EUVD-2026-114071

No special conditions - remote unauthenticated exploitation (AV:N/PR:N/UI:N) against default CoreShop installations through 1.5.5 that expose the api/Good/GetGoodsPageList endpoint. The specific prerequisite is that the attacker supplies an 'order' parameter value appended to the query's ORDER BY clause; the SqlSugar field-name validation is bypassed via subqueries, enabling blind extraction. Limiting factors: exploitation requires network reachability of the API endpoint and that the instance is running a vulnerable version (≤1.5.5); impact observed in the evidence is read-only data extraction (member accounts and orders) rather than write/modification or service disruption.

This is a genuinely high-priority issue for anyone running CoreShop, though its real-world reach is constrained by the product's niche footprint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a fully remote, unauthenticated, low-complexity attack against a public API endpoint, and the CWE-89 SQL injection with described boolean-based and time-based blind techniques makes data extraction practical even without error output. The vendor/VulnCheck-assessed score of 8.7 is consistent with that vector, and impact is scoped to confidentiality (VC:H, with VI:N/VA:N) - reflecting read-oriented blind extraction of member accounts and orders rather than data modification or denial of service. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits the signal mix: no CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active or widespread exploitation, while a public technical write-up (hackmd) and a GitHub issue lower the barrier to weaponization. In short: a real, patch-now-this-week issue on exposed instances, but absent KEV/EPSS data it should be treated as credible-and-easy rather than confirmed-under-mass-exploitation. EPSS and KEV data are missing from the input and should be checked before final prioritization.

An unauthenticated attacker sends a crafted request to the public api/Good/GetGoodsPageList endpoint, placing a malicious subquery in the order parameter that is appended to the ORDER BY clause. Because the injection slips past SqlSugar's field check, the attacker uses boolean-based or time-based blind responses to iteratively read member account and order data. A public technical write-up describing the order-parameter injection exists, lowering the effort to reproduce the attack.