| タイトル | Webkul Bagisto <=2.4.4 Improper Input Validation |
|---|
| 説明 | Bagisto 2.4.4 contains multiple server-side business validation bypasses in frontend RMA creation. A normal authenticated customer can modify request parameters and create RMA records that violate quantity, resolution, and reason constraints enforced by the user interface.
The affected endpoint is POST /customer/account/rma/store. The frontend limits fields such as rma_qty, resolution_type, and rma_reason_id, but the backend validation checks mainly that the fields are present and then persists attacker-controlled values. A customer can intercept the RMA creation request and submit an excessive rma_qty beyond the allowed quantity, forge a resolution_type that the UI does not allow for the order item, or submit an rma_reason_id that does not belong to the chosen resolution_type.
The impact is unauthorized manipulation of the after-sales workflow and RMA data integrity. A customer can create RMA records with excessive quantities, unsupported resolution types, or inconsistent reason mappings. These manipulated records may mislead customer-service staff, pollute operational records, and affect later cancellation, return, refund, or reporting workflows. The issue is a server-side business logic and input validation failure because the server relies on UI restrictions instead of revalidating the rules before storing the RMA.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| ソース | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/34_36_english_vulnerability_report.md |
|---|
| ユーザー | Mitch_45 (UID 99298) |
|---|
| 送信 | 2026年06月26日 06:49 (2 月 ago) |
|---|
| モデレーション | 2026年08月17日 18:16 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 391309 [Webkul Bagisto 迄 2.4.4 store rma_qty/resolution_type/rma_reason_id 特権昇格] |
|---|
| ポイント | 20 |
|---|