| शीर्षक | PickMall lilishop 4e6d563a4f0fa53880dd1420ce0904fc6e29f9e9 Missing Authorization |
|---|
| विवरण | PickMall lilishop contains an authorization bypass vulnerability in the buyer invoice-list functionality. The authenticated GET /buyer/trade/receipt endpoint forwards client-supplied search parameters to the invoice query without binding the member identifier to the currently authenticated buyer. As a result, an authenticated buyer can omit the optional memberId parameter to retrieve invoice records belonging to other members, or supply another member's identifier to query that member's records directly. Successful exploitation may disclose sensitive invoice information, including taxpayer identifiers, personal or company names, addresses, phone numbers, banking information, receipt contact details, and linked order information. The issue was reproduced at commit 4e6d563a4f0fa53880dd1420ce0904fc6e29f9e9 (v4.4-145-g4e6d563a).
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| स्रोत | ⚠️ https://github.com/lilishop/lilishop/issues/149 |
|---|
| उपयोगकर्ता | cztang (UID 101252) |
|---|
| सबमिशन | 18/09/2026 03:54 AM (18 दिन पहले) |
|---|
| संयम | 05/10/2026 06:09 PM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413631 [PickMall Lilishop तक 4.2.4 Buyer Invoice List /buyer/trade/receipt memberId अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|