CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

Summary

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

Remediation

1. Inventory every CoreUnion CoreShop deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4
• Advisoryhttps://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection
• Advisoryhttps://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist
• Referencehttps://github.com/CoreUnion/CoreShop
• Referencehttps://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/BaseRepository.cs#L155-L165
• Referencehttps://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/GoodController.cs#L233-L241
• Referencehttps://github.com/CoreUnion/CoreShop/issues/20