CVE-2026-111348
CVE-2026-111348 · Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
CVSS 5.3 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
likeshop
- Versiones
- ≥ 0, ≤ 3.5.1: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/likeshop-after-sale-api-cross-user-idor
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/controller/AfterSale.php#L52-L102
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/logic/AfterSaleLogic.php#L251-L377
- https://github.com/likeadmin-likeshop/likeshop
- https://www.vulncheck.com/advisories/likeshop-through-3.5.1-idor-via-aftersale-api-refund-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-111348