| Título | Webkul Bagisto <=2.4.4 Improper Input Validation |
|---|
| Descrição | Bagisto 2.4.4 contains multiple server-side business validation bypasses in frontend RMA creation. A normal authenticated customer can modify request parameters and create RMA records that violate quantity, resolution, and reason constraints enforced by the user interface.
The affected endpoint is POST /customer/account/rma/store. The frontend limits fields such as rma_qty, resolution_type, and rma_reason_id, but the backend validation checks mainly that the fields are present and then persists attacker-controlled values. A customer can intercept the RMA creation request and submit an excessive rma_qty beyond the allowed quantity, forge a resolution_type that the UI does not allow for the order item, or submit an rma_reason_id that does not belong to the chosen resolution_type.
The impact is unauthorized manipulation of the after-sales workflow and RMA data integrity. A customer can create RMA records with excessive quantities, unsupported resolution types, or inconsistent reason mappings. These manipulated records may mislead customer-service staff, pollute operational records, and affect later cancellation, return, refund, or reporting workflows. The issue is a server-side business logic and input validation failure because the server relies on UI restrictions instead of revalidating the rules before storing the RMA.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| Fonte | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/34_36_english_vulnerability_report.md |
|---|
| Utilizador | Mitch_45 (UID 99298) |
|---|
| Submissão | 26/06/2026 06h49 (há 2 meses) |
|---|
| Moderação | 17/08/2026 18h16 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 391309 [Webkul Bagisto até 2.4.4 store rma_qty/resolution_type/rma_reason_id Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|