CVE-2026-111348
CVE-2026-111348 · Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
CVSS 5.3 · Mittel · EPSS 0,3%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
likeshop
- Softwareversionen
- ≥ 0, ≤ 3.5.1: Betroffen (custom)
Keine Korrektur veröffentlicht
Originalquellen
- https://hackmd.io/@hieuPenguinnn/likeshop-after-sale-api-cross-user-idor
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/controller/AfterSale.php#L52-L102
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/logic/AfterSaleLogic.php#L251-L377
- https://github.com/likeadmin-likeshop/likeshop
- https://www.vulncheck.com/advisories/likeshop-through-3.5.1-idor-via-aftersale-api-refund-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-111348