Description
CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
CoreUnion CoreShop
Default version status: unaffected
0 to ≤ 1.5.5affected
pkg:github/CoreUnion/CoreShopReferences
- https://github.com/CoreUnion/CoreShop/issues/20 ↗
- https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4 ↗
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/GoodController.cs#L233-L241 ↗
- https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/BaseRepository.cs#L155-L165 ↗
- https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection ↗
- https://github.com/CoreUnion/CoreShop ↗
- https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist ↗