CVE-2025-56162

YOSHOP 2.0 is vulnerable to an unauthenticated SQL injection due to improper neutralization of special elements in the goodsIds parameter of the /api/goods/listByIds endpoint. The root cause is the getListByIds function, which concatenates user-supplied input into the orderRaw('field(goods_id, .....