CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

Summary

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.

Remediation

1. Inventory every CoreUnion CoreShop deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/CoreUnion/CoreShop/commit/e40085b81d78ea55790305bc4a1592309b294048
• Advisoryhttps://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection
• Advisoryhttps://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-agent-getgoodspagelist
• Referencehttps://github.com/CoreUnion/CoreShop
• Referencehttps://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/Good/CoreCmsGoodsRepository.cs#L1622-L1730
• Referencehttps://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/AgentController.cs#L164-L170
• Referencehttps://github.com/CoreUnion/CoreShop/issues/20