Threats Tagged 'ghsa-96x2-4759-fjj4'

Mall4cloud versions up to 4.0 contain an insecure direct object reference vulnerability that allows authenticated merchants to access other shops' buyer shipping addresses. This occurs via the OrderController's getOrderAddr handler, where attackers can enumerate orderAddrId values to retrieve consignee names, mobile numbers, addresses, and post codes across the platform.