CVE-2025-56162

YOSHOP version 2.0 is vulnerable to an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The root cause is the getListByIds function improperly concatenating user input into the orderRaw('field(goods_id, ...)') query. Attackers can exploit this to enume...