| 标题 | Webkul Bagisto <=2.4.4 Information Disclosure |
|---|
| 描述 | Bagisto 2.4.4 contains a broken access control vulnerability in the backend customer search endpoint. A low-privileged backend user without Customers permissions can directly query the customer search API and enumerate customer records.
The affected endpoint is GET /admin/customers/search?query=... . A user with only minimal admin access is blocked from opening the normal customer-management page, but direct requests to this search endpoint return JSON customer records. Queries can use partial names, partial email addresses, or broad patterns such as @ to enumerate customers. The issue exists because the route is not properly covered by ACL mapping and the controller returns raw customer model data without an additional authorization check or response minimization.
The impact is unauthorized customer information disclosure and bulk enumeration. Exposed fields may include customer ID, first name, last name, email address, status, customer group ID, channel ID, verification state, and token. The token field is especially sensitive because it is related to the customer account verification workflow. This allows a low-privileged admin user to build customer lists and retrieve internal account data that should require customer-management privileges.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation. |
|---|
| 来源 | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/10_english_vulnerability_report.md |
|---|
| 用户 | Mitchell_45 (UID 98150) |
|---|
| 提交 | 2026-06-26 06時41分 (2 月前) |
|---|
| 管理 | 2026-08-14 09時44分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 389975 [Webkul Bagisto 直到 2.4.4 Customer Search /admin/customers/search 查询 信息公开] |
|---|
| 积分 | 20 |
|---|