Description
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
youlaitech youlai-mall
Default version status: unaffected
de86041995fa3a8b1e959b86232cb9f0bf52ff46 to ≤ 9f62de811d478b3ab6b27438efd58e2c4fdb4c31affected
pkg:github/youlaitech/youlai-mallReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/youlai-mall-order-list-cross-member-disclosure ↗
- https://github.com/youlaitech/youlai-mall/blob/9f62de811d478b3ab6b27438efd58e2c4fdb4c31/mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java#L33-L38 ↗
- https://github.com/youlaitech/youlai-mall/blob/9f62de811d478b3ab6b27438efd58e2c4fdb4c31/mall-oms/oms-boot/src/main/resources/mapper/OmsOrderMapper.xml#L15-L52 ↗
- https://github.com/youlaitech/youlai-mall ↗
- https://www.vulncheck.com/advisories/youlai-mall-through-commit-9f62de8-order-information-disclosure-via-app-order-list ↗