CVE-2026-119656 Details

A SQL injection vulnerability has been identified in CoreShop by CoreUnion, affecting versions through 1.5.5. The issue resides in the 'api/Agent/GetGoodsPageList' endpoint, where the 'order' parameter is concatenated into an ORDER BY clause without proper validation. This flaw allows anonymous attackers to inject subqueries that bypass SqlSugar's field checks, enabling the extraction of member accounts and orders through boolean-based or time-based blind SQL injection techniques.

To address this vulnerability, it is recommended to implement proper validation for the 'order' parameter. This can be done by establishing an allow-list of acceptable column names and ensuring that the input is sanitized before being concatenated into the SQL query. Additionally, applying authorization checks to the endpoint can prevent unauthenticated access.