Priority MEDIUM 57
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids.
Vulnerabilities
7 records
TI-2024-27620 CVE-2024-41432 · GHSA-v66p-qc5x-9g87
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811.
Priority MEDIUM 63
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811.
TI-2024-05353 CVE-2024-5766 · GHSA-x3p6-qcrr-6pv2
Likeshop Merchandise admin cross site scripting
Priority LOW 23
A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic.
TI-2024-23154 CVE-2024-34949
SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL…
Priority HIGH 77
SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList function, exploited at the /admin/order/lists.html endpoint.
TI-2024-15980 CVE-2024-24028 · GHSA-3537-379x-x582
Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows…
Priority LOW 26
Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.
TI-2024-15979 CVE-2024-24027 · GHSA-666p-vffc-r2ch
SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL…
Priority HIGH 67
SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic::getFansLists.
TI-2024-00319 CVE-2024-0352 · GHSA-hq93-g2wv-xwjm
Likeshop HTTP POST Request File.php userFormImage unrestricted upload
Priority CRITICAL 86
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311.