Threat database

Yshopmall versions up to 2.0.0 have an insecure direct object reference vulnerability in the after-sales API. Authenticated users can access or modify other members' after-sales data by supplying their after-sales id and orderCode. This allows unauthorized viewing, tampering, or deletion of after-sales records via specific API calls.

Yshopmall versions up to 2.0.0 have an insecure direct object reference vulnerability in the member address API. Authenticated users can enumerate sequential address IDs to read, overwrite, or delete other members' shipping addresses, exposing personal information such as recipient names, phone numbers, and addresses.

yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.

A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.