Summary
CoreShop through version 1.5.5 contains a high-severity SQL injection vulnerability in the unauthenticated api/Agent/GetGoodsPageList endpoint. An attacker may manipulate the order parameter to influence an ORDER BY clause and extract member or order data through boolean-based or time-based blind techniques when the endpoint is publicly reachable.
CoreShop through version 1.5.5 contains a high-severity SQL injection vulnerability in the unauthenticated api/Agent/GetGoodsPageList endpoint. An attacker may manipulate the order parameter to influence an ORDER BY clause and extract member or order data through boolean-based or time-based blind techniques when the endpoint is publicly reachable.
Affected context
The vulnerability occurs in CoreShop deployments where the Agent goods-list API is exposed without authentication and the order parameter is incorporated into database sorting logic. Risk is higher when application-level field checks do not constrain the resulting SQL expression and the database account can read sensitive member or order records.
The vulnerability occurs in CoreShop deployments where the Agent goods-list API is exposed without authentication and the order parameter is incorporated into database sorting logic. Risk is higher when application-level field checks do not constrain the resulting SQL expression and the database account can read sensitive member or order records.
Exploit preconditions
- Attack surface: The
api/Agent/GetGoodsPageListHTTP endpoint - Required access: No authentication may be required when the endpoint is publicly accessible
- Trigger point: Processing of the user-controlled
orderparameter during query construction - Why exploitation is possible: Input is appended to an
ORDER BYclause, while validation can be bypassed, allowing database expressions to influence observable query behavior
- Attack surface: The
api/Agent/GetGoodsPageListHTTP endpoint - Required access: No authentication may be required when the endpoint is publicly accessible
- Trigger point: Processing of the user-controlled
orderparameter during query construction - Why exploitation is possible: Input is appended to an
ORDER BYclause, while validation can be bypassed, allowing database expressions to influence observable query behavior
Why this happens
The underlying bug is the unsafe incorporation of client-controlled sorting input into SQL query construction. Rather than restricting the value to a server-defined set of column names and directions, the application permits input to affect an ORDER BY expression in a way that can be interpreted by the database. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
The underlying bug is the unsafe incorporation of client-controlled sorting input into SQL query construction. Rather than restricting the value to a server-defined set of column names and directions, the application permits input to affect an ORDER BY expression in a way that can be interpreted by the database. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
Potential impact
- An attacker may infer sensitive database values through blind query behavior
- Member accounts and order information could be exposed
- Database confidentiality and privacy may be compromised
- Excessive query execution could affect application availability
- Retrieved information could support account abuse or further attacks
- An attacker may infer sensitive database values through blind query behavior
- Member accounts and order information could be exposed
- Database confidentiality and privacy may be compromised
- Excessive query execution could affect application availability
- Retrieved information could support account abuse or further attacks
General mitigation guidance
Mitigation generally focuses on reducing trust in client-controlled sorting input and separating query structure from request data.
Common defensive patterns include:
- Map accepted sort fields and directions to a fixed server-side allowlist
- Reject unknown, ambiguous, or structurally complex ordering values
- Use parameterized query mechanisms where supported, while recognizing that identifiers may require explicit allowlisting
- Apply strict input validation before query construction
- Run the application with a database identity limited to the data and operations it requires
- Require authentication and authorization for endpoints that expose sensitive records
- Avoid returning detailed database errors or timing signals to clients
Mitigation generally focuses on reducing trust in client-controlled sorting input and separating query structure from request data.
Common defensive patterns include:
- Map accepted sort fields and directions to a fixed server-side allowlist
- Reject unknown, ambiguous, or structurally complex ordering values
- Use parameterized query mechanisms where supported, while recognizing that identifiers may require explicit allowlisting
- Apply strict input validation before query construction
- Run the application with a database identity limited to the data and operations it requires
- Require authentication and authorization for endpoints that expose sensitive records
- Avoid returning detailed database errors or timing signals to clients
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules identifying request parameters concatenated into SQL fragments or ORM ordering expressions
- Code review checks for dynamic
ORDER BYconstruction and incomplete field allowlists - Automated API testing that supplies unexpected sorting values and compares response timing, status, and content behavior
- Database and web logs showing repeated anomalous requests to the goods-list endpoint or unusual query latency
- Policy enforcement requiring parameterized queries and server-side mappings for dynamic identifiers
Automated security review tools may help identify unsafe query construction, but findings should be validated against the application's actual database behavior.
Organizations can look for this weakness through:
- Static analysis rules identifying request parameters concatenated into SQL fragments or ORM ordering expressions
- Code review checks for dynamic
ORDER BYconstruction and incomplete field allowlists - Automated API testing that supplies unexpected sorting values and compares response timing, status, and content behavior
- Database and web logs showing repeated anomalous requests to the goods-list endpoint or unusual query latency
- Policy enforcement requiring parameterized queries and server-side mappings for dynamic identifiers
Automated security review tools may help identify unsafe query construction, but findings should be validated against the application's actual database behavior.
