CVE-2023-36331

Name of the Vulnerable Software and Affected Versions xmall version 1.1

Description An issue exists in xmall version 1.1 related to access control. Specifically, the /member/orderList API endpoint allows unauthorized access to other users' order details. This is achieved by manipulating the userId query parameter. The API endpoint /member/orderList is vulnerable. The userId parameter is susceptible to manipulation.

Recommendations Apply appropriate access controls to the /member/orderList API endpoint to prevent unauthorized access to order details. Ensure the userId parameter is properly validated to restrict access to only the intended user's order information.