| عنوان | Evershop <= v2.0.1 Insecure Direct Object Reference |
|---|
| الوصف | A critical authorization vulnerability has been identified in EverShop's GraphQL API that allows any unauthenticated user to access complete order information, including customer personally identifiable information (PII), shipping addresses, billing details, and purchase history. This is a textbook Insecure Direct Object Reference (IDOR) vulnerability where the application fails to verify whether the requesting user has permission to access the requested order data. |
|---|
| المصدر | ⚠️ https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md |
|---|
| المستخدم | ictrun (UID 83482) |
|---|
| ارسال | 23/10/2025 01:17 AM (11 أشهر منذ) |
|---|
| الاعتدال | 09/11/2025 07:29 AM (17 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 331639 [EverShop حتى 2.0.1 Order Order.resolvers.js uuid تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|