CVE-2026-119655 Details

A SQL injection vulnerability has been identified in CoreShop versions through 1.5.5. The issue resides in the 'api/Good/GetGoodsPageList' endpoint, where the 'order' parameter is not properly validated before being appended to the SQL 'ORDER BY' clause. This flaw allows attackers to inject subqueries that bypass SqlSugar's field validation, exploiting boolean-based or time-based blind injection techniques to extract data from member accounts and orders.

To address this vulnerability, implement proper validation and sanitization of the 'order' parameter before it is concatenated into the 'ORDER BY' clause. This can be done by establishing an allow-list of acceptable column names and ensuring that the input is cleaned of any potentially harmful SQL elements. Additionally, consider replacing the current string-based sorting method with a typed selector approach that eliminates the risk of SQL injection.