Authenticated Seller IOR in PickMall lilishop Product Overwrite

Executive Summary

This vulnerability is an insecure direct object reference (IDOR) in PickMall lilishop through version 4.4. It allows authenticated sellers to overwrite any store's product by providing another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details, SKUs, and reassign products to their own store.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PUT requests to /store/goods/goods/update/{goodsId} endpoints. Monitor logs for repeated attempts to modify product details or SKUs. Inspect network traffic for suspicious activity targeting the goods update functionality.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to manipulate product listings by changing details, SKUs, or ownership of products across stores. For businesses, this could lead to financial loss, reputational damage, or operational disruptions due to incorrect product information or unauthorized product transfers.

Useful 0 Not Useful 0

Mitigation Strategies

Implement strict access controls to restrict PUT requests to authorized users only. Validate and sanitize all input parameters in the goods update endpoint. Update to the latest version of PickMall lilishop if a patch is available.

Useful 0 Not Useful 0