CVE-2026-110122 in lilishop
Summary
by MITRE • 10/13/2026
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in PickMall lilishop versions through 4.4 represents a classic Insecure Direct Object Reference (IDOR), formally categorized under CWE-639. This flaw arises from the application's failure to enforce proper authorization checks when processing requests that modify critical business data, specifically product freight templates. The core technical deficiency lies within the GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight methods, which accept an identifier for a goods item or SKU and proceed to update its associated shipping configuration without verifying whether the authenticated user initiating the request owns the entity being modified. By relying solely on client-supplied identifiers in the PUT /store/goods/goods/freight endpoint, the system assumes that access control is handled at a higher level or by design, which proves incorrect in this implementation.
From an operational perspective, this lack of store-scoped validation allows any authenticated seller to manipulate the shipping parameters of products belonging to other merchants on the platform. An attacker can exploit this by crafting HTTP requests with arbitrary goods IDs that belong to competitors while retaining their own valid authentication tokens. This capability enables the malicious actor to bind their own freight templates to rival stores' items, effectively altering the shipping charges applied at checkout. Such manipulation can lead to significant financial discrepancies, including undercharging customers to gain a competitive advantage or overcharging them to drive traffic away from legitimate sellers. The integrity of the marketplace's pricing and logistics logic is thereby compromised, as the system fails to isolate data modifications within the boundaries of the authenticated user's store context.
This vulnerability aligns with MITRE ATT&CK technique T1078, specifically relating to valid accounts being used for unauthorized access or modification of resources. The exploitation path involves leveraging existing credentials rather than breaking into an account, which makes detection more challenging as the traffic appears legitimate from a network perspective. To mitigate this issue, developers must implement strict object-level authorization checks within the service layer methods responsible for updating goods and SKUs. This requires validating that the store ID associated with the authenticated session matches the store ID of the target resource before any database updates are executed. Additionally, implementing comprehensive logging and monitoring for unusual patterns in freight template modifications can help detect potential exploitation attempts in real-time until a permanent code fix is deployed.