| tiêu đề | Webkul Bagisto <=2.4.4 Business Logic Errors |
|---|
| Mô tả | Bagisto 2.4.4 contains server-side RMA state validation bypasses in frontend customer RMA operations. A normal authenticated customer can directly send state-changing requests and force invalid RMA state transitions that the frontend no longer allows.
Affected endpoints include POST /customer/account/rma/update-status/{id} and POST /customer/account/rma/cancel/{id}. The frontend computes whether actions such as closing or canceling an RMA should be available, but the backend does not fully enforce the same state-transition rules. For example, a customer can directly submit a status update request and force an RMA from DECLINED to SOLVED even when the close action is not visible in the UI. A related case allows direct cancellation of an already solved RMA because the backend checks ownership and whether the request is already canceled, but does not enforce a complete cancelable-state decision.
The impact is unauthorized manipulation of the RMA lifecycle by the owning customer. This can prematurely terminate after-sales workflows, overwrite processed states, confuse support staff, and introduce incorrect status data into notifications, reporting, and audit trails. The issue is a business logic flaw caused by relying on frontend action visibility instead of enforcing state-transition rules on the server.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| Nguồn | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/37_38_english_vulnerability_report.md |
|---|
| Người dùng | Mitch45 (UID 99299) |
|---|
| Đệ trình | 26/06/2026 06:44 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 16/08/2026 20:05 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 391194 [Webkul Bagisto đến 2.4.4 RMA State Validation update-status nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|