CoreShop by CoreUnion, when running any version up through 1.5.5, has an unauthenticated SQL injection flaw in the Agent/GetGoodsPageList API. The flaw occurs when the order parameter is appended to an ORDER BY clause. Attackers can inject arbitrary subqueries, bypassing the SqlSugar framework’s field restriction, which allows retrieval of member accounts and order data through boolean‑based or time‑based blind techniques. This results in unauthorized disclosure of confidential customer information without requiring prior authentication.

CoreUnion CoreShop versions prior to 1.5.6, specifically all releases through 1.5.5, are affected. The vulnerability exists in the Agent/GetGoodsPageList endpoint of the Coreshop API.

The base CVSS score of 8.7 indicates high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a simple HTTP request and no authentication, making it relatively easy for an attacker to gain access to sensitive data. The likely attack vector is a direct request to the /api/Agent/GetGoodsPageList endpoint with a crafted order parameter.