EUVD-2026-114071 reports unauthenticated SQL injection in CoreShop
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- CoreUnion
- Product
- CoreShop
- First seen
Summary
The EUVD entry, shared on Mastodon, says CoreShop through 1.5.5 has an unauthenticated SQL injection in the api/Good/GetGoodsPageList endpoint via the order parameter. It assigns a CVSS v3.1 score of 8.7 and says attackers can inject subqueries that bypass SqlSugar's field check.
If you use CoreUnion
Check CoreUnion for a fixed CoreShop release and upgrade past 1.5.5
Block or restrict access to the api/Good/GetGoodsPageList endpoint until patched
Review database and web logs for abnormal ORDER BY parameters
Block or restrict access to the api/Agent/GetGoodsPageList endpoint until patched
What the sources say 2
· Mastodon: “CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause.” Source
· Mastodon: “CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY.” Source