| タイトル | PickMall lilishop v4.4 Missing Authorization |
|---|
| 説明 | lilishop v4.4 contains a missing authorization vulnerability in the buyer account mobile-binding functionality. The POST /buyer/passport/member/bindMobile endpoint is reachable without authentication and identifies the account to modify only from the user-supplied username parameter, without binding the operation to an authenticated member or verifying ownership of the target account. The issue is compounded by the SMS verification implementation, which accepts the literal value "0" as a valid verification code. An unauthenticated remote attacker can therefore rebind a victim account to an attacker-controlled mobile number and then use POST /buyer/passport/member/smsLogin with code "0" to obtain a valid access token for the victim account. Successful exploitation results in persistent member account takeover. The issue was reproduced at commit 4e6d563a4f0fa53880dd1420ce0904fc6e29f9e9 (v4.4-145-g4e6d563a).
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| ソース | ⚠️ https://github.com/lilishop/lilishop/issues/148 |
|---|
| ユーザー | cztang (UID 101252) |
|---|
| 送信 | 2026年09月18日 03:34 (18 日 ago) |
|---|
| モデレーション | 2026年10月05日 18:09 (18 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413630 [PickMall Lilishop 迄 4.2.4 Mobile Binding bindMobile username 特権昇格] |
|---|
| ポイント | 20 |
|---|