| Title | PickMall lilishop v4.4 Missing Authorization |
|---|
| Description | lilishop v4.4 contains a missing authorization vulnerability in the buyer account mobile-binding functionality. The POST /buyer/passport/member/bindMobile endpoint is reachable without authentication and identifies the account to modify only from the user-supplied username parameter, without binding the operation to an authenticated member or verifying ownership of the target account. The issue is compounded by the SMS verification implementation, which accepts the literal value "0" as a valid verification code. An unauthenticated remote attacker can therefore rebind a victim account to an attacker-controlled mobile number and then use POST /buyer/passport/member/smsLogin with code "0" to obtain a valid access token for the victim account. Successful exploitation results in persistent member account takeover. The issue was reproduced at commit 4e6d563a4f0fa53880dd1420ce0904fc6e29f9e9 (v4.4-145-g4e6d563a).
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| Source | ⚠️ https://github.com/lilishop/lilishop/issues/148 |
|---|
| User | cztang (UID 101252) |
|---|
| Submission | 09/18/2026 03:34 (18 days ago) |
|---|
| Moderation | 10/05/2026 18:09 (18 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 413630 [PickMall Lilishop up to 4.2.4 Mobile Binding bindMobile username improper authorization] |
|---|
| Points | 20 |
|---|