| عنوان | PickMall lilishop v4.4 Missing Authorization |
|---|
| الوصف | lilishop v4.4 contains a missing authorization vulnerability in the buyer account mobile-binding functionality. The POST /buyer/passport/member/bindMobile endpoint is reachable without authentication and identifies the account to modify only from the user-supplied username parameter, without binding the operation to an authenticated member or verifying ownership of the target account. The issue is compounded by the SMS verification implementation, which accepts the literal value "0" as a valid verification code. An unauthenticated remote attacker can therefore rebind a victim account to an attacker-controlled mobile number and then use POST /buyer/passport/member/smsLogin with code "0" to obtain a valid access token for the victim account. Successful exploitation results in persistent member account takeover. The issue was reproduced at commit 4e6d563a4f0fa53880dd1420ce0904fc6e29f9e9 (v4.4-145-g4e6d563a).
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| المصدر | ⚠️ https://github.com/lilishop/lilishop/issues/148 |
|---|
| المستخدم | cztang (UID 101252) |
|---|
| ارسال | 18/09/2026 03:34 AM (18 أيام منذ) |
|---|
| الاعتدال | 05/10/2026 06:09 PM (18 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 413630 [PickMall Lilishop حتى 4.2.4 Mobile Binding bindMobile username تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|