| शीर्षक | PickMall lilishop v4.4 Missing Authorization |
|---|
| विवरण | lilishop v4.4 contains a missing authorization vulnerability in the buyer account mobile-binding functionality. The POST /buyer/passport/member/bindMobile endpoint is reachable without authentication and identifies the account to modify only from the user-supplied username parameter, without binding the operation to an authenticated member or verifying ownership of the target account. The issue is compounded by the SMS verification implementation, which accepts the literal value "0" as a valid verification code. An unauthenticated remote attacker can therefore rebind a victim account to an attacker-controlled mobile number and then use POST /buyer/passport/member/smsLogin with code "0" to obtain a valid access token for the victim account. Successful exploitation results in persistent member account takeover. The issue was reproduced at commit 4e6d563a4f0fa53880dd1420ce0904fc6e29f9e9 (v4.4-145-g4e6d563a).
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| स्रोत | ⚠️ https://github.com/lilishop/lilishop/issues/148 |
|---|
| उपयोगकर्ता | cztang (UID 101252) |
|---|
| सबमिशन | 18/09/2026 03:34 AM (18 दिन पहले) |
|---|
| संयम | 05/10/2026 06:09 PM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413630 [PickMall Lilishop तक 4.2.4 Mobile Binding bindMobile username अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|