Listen to this Post
This Insecure Direct Object Reference (IDOR) vulnerability exists within the `reorder()` method of the `OrderController.php` controller. The function is accessible via the defined route customer/account/orders/reorder/{id}. Unlike other customer order functions (view, cancel) which perform proper authorization checks, the `reorder` method directly fetches an order from the database using only the user-supplied order ID ($id) parameter without verifying that the retrieved order belongs to the currently authenticated customer session. An attacker can simply change the `{id}` value in the HTTP request to reference another customer’s valid order number. The application then proceeds to add all items from that referenced order into the attacker’s active shopping cart, as the system incorrectly trusts the user’s control over the object reference.
Platform: Webkul Shop
Version: Not Specified
Vulnerability: IDOR
Severity: High
Date: 2024-05-15
Prediction: Patch Expected 2024-06-15
What Undercode Say:
Bash commands for PoC:
curl -c cookies.txt -X POST "http://target.xxx/customer/login" -d "[email protected]&password=123qwe" curl -b cookies.txt "http://target.xxx/customer/account/orders/reorder/1" curl -b cookies.txt "http://target.xxx/api/checkout/cart"
How Exploit:
Manipulate `{id}` parameter in `reorder` endpoint. No ownership validation performed. Victim’s order items added to attacker cart.
Protection from this CVE:
Implement authorization check. Validate order ownership. Use indirect reference maps.
Impact:
Information disclosure. Potential fraud. Social engineering data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
