Description
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Shopizer Shopizer
Default version status: unaffected
0 to ≤ 3.2.5affected
pkg:github/shopizer-ecommerce/shopizerReferences
- https://github.com/shopizer-ecommerce/shopizer/issues/1112 ↗
- https://hackmd.io/@hieuPenguinnn/shopizer-rest-product-review-idor ↗
- https://github.com/shopizer-ecommerce/shopizer/blob/9a1602a664ab882b5420ff4339db45af44a48423/sm-shop/src/main/java/com/salesmanager/shop/populator/catalog/PersistableProductReviewPopulator.java#L66 ↗
- https://github.com/shopizer-ecommerce/shopizer ↗
- https://www.vulncheck.com/advisories/shopizer-through-3.2.5-authorization-bypass-via-product-review-customerid ↗