CVE-2024-0412 is a medium-severity vulnerability affecting DeShang DSShop versions 3.0 and 3.1. The vulnerability is classified under CWE-284, which pertains to improper access controls. Specifically, the issue resides in the public/install.php file within the HTTP GET request handler component. The vulnerability allows an unauthenticated remote attacker to manipulate requests to bypass intended access restrictions. This could potentially allow unauthorized users to access installation or configuration routines that should be restricted, possibly leading to information disclosure or unauthorized configuration changes. The CVSS 3.1 base score is 5.3, reflecting a network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The impact is limited to confidentiality (C:L) with no impact on integrity or availability. Although no public exploits are currently known in the wild, the vulnerability details have been publicly disclosed, increasing the risk of exploitation. No patches or fixes have been linked yet, so affected organizations must rely on mitigations until an official update is released.

For European organizations using DeShang DSShop versions 3.0 or 3.1, this vulnerability could lead to unauthorized access to installation or configuration endpoints, potentially exposing sensitive configuration data or allowing attackers to alter installation parameters. While the direct impact on integrity and availability is not indicated, unauthorized access to installation routines could facilitate further attacks or unauthorized system modifications if chained with other vulnerabilities. This risk is particularly relevant for e-commerce platforms or online stores relying on DSShop, as exposure of configuration details could lead to customer data exposure or compromise of payment processing components. The medium severity score suggests a moderate risk, but the lack of required privileges and user interaction increases the likelihood of exploitation. European organizations with publicly accessible DSShop installations are at higher risk, especially if the install.php endpoint is not properly secured or removed after installation.

1. Immediate mitigation should include restricting access to the public/install.php file by implementing IP whitelisting or web application firewall (WAF) rules to block unauthorized HTTP GET requests targeting this endpoint. 2. Disable or remove the install.php file from production environments once the installation is complete to eliminate the attack surface. 3. Monitor web server logs for suspicious access attempts to install.php or related endpoints to detect potential exploitation attempts early. 4. If possible, deploy network segmentation to isolate the DSShop server from public networks except for necessary traffic. 5. Regularly review and update access control configurations to ensure no unintended exposure of administrative or installation interfaces. 6. Stay alert for official patches or updates from DeShang and apply them promptly once available. 7. Conduct security assessments and penetration testing focused on access control weaknesses in the DSShop environment to identify and remediate similar issues.