BeikeShop up to 2.0.0.31 Guest Order Lookup OrderRepo.php getOrderByNumber order_number behavioral workflow

Summaryinfo

A vulnerability classified as critical was found in BeikeShop up to 2.0.0.31. The affected element is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Executing a manipulation of the argument order_number can lead to behavioral workflow. This vulnerability is tracked as CVE-2026-124576. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in BeikeShop up to 2.0.0.31 and classified as critical. This vulnerability affects the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. The manipulation of the argument order_number with an unknown input leads to a behavioral workflow vulnerability. The CWE definition for the vulnerability is CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence or timeframe. As an impact it is known to affect confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability was named CVE-2026-124576. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

By approaching the search of inurl:beike/Repositories/OrderRepo.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.0.0.32 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• BeikeShop

Version

• 2.0.0.0
• 2.0.0.1
• 2.0.0.2
• 2.0.0.3
• 2.0.0.4
• 2.0.0.5
• 2.0.0.6
• 2.0.0.7
• 2.0.0.8
• 2.0.0.9
• 2.0.0.10
• 2.0.0.11
• 2.0.0.12
• 2.0.0.13
• 2.0.0.14
• 2.0.0.15
• 2.0.0.16
• 2.0.0.17
• 2.0.0.18
• 2.0.0.19
• 2.0.0.20
• 2.0.0.21
• 2.0.0.22
• 2.0.0.23
• 2.0.0.24
• 2.0.0.25
• 2.0.0.26
• 2.0.0.27
• 2.0.0.28
• 2.0.0.29
• 2.0.0.30
• 2.0.0.31

License

• open-source

Website

• Product: https://github.com/beikeshop/beikeshop/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1038160: beikeshop BeikeShop <= 2.0.0.31 Improper Enforcement of Behavioral Workflow (by fernando viana)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion