Executive Summary

This vulnerability exists in newbee-mall-plus up to version 2.4.1, specifically in the executeSeckill function of the /seckillExecution/ file. It involves manipulation of the userid argument, which leads to an authorization bypass. This means an attacker can remotely exploit this flaw to bypass authorization controls, although the attack is considered to have high complexity and is difficult to exploit. A public exploit is available.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to bypass authorization remotely by manipulating the userid argument. This could lead to unauthorized actions or access within the affected application, potentially compromising the integrity of operations related to the executeSeckill function. However, the attack complexity is high and exploitability is difficult.

Useful 0 Not Useful 0