The vulnerability exists in the GetGoodsPageList API endpoint of CoreShop 1.5.5 and earlier. An attacker can supply an arbitrary value in the order parameter, which is appended directly to an ORDER BY clause without validation. This allows the injection of SQL subqueries, enabling boolean‑based or time‑based blind attacks to retrieve sensitive data such as member accounts and order records. The weakness is a classic SQL injection (CWE‑89).

CoreUnion’s CoreShop product, affected through version 1.5.5. The vulnerability is present in any environment that exposes the public API endpoint without additional access controls.

The score of 8.7 on the CVSS indicates a high level of criticality. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the absence of a KEV listing does not preclude a real‑world attack; the unbounded endpoint suggests that exploitation is straightforward for attackers who can send crafted requests. The likely attack vector is via the public API endpoint; attackers only need to construct a malicious order parameter to trigger the injection.