漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
Vulnerability Description
Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/_ORDER_ID_ or use the address and billing information of other customers by manipulating the shipping_address_id and billing_address_id parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/_REVIEW_ID.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Vulnerability Type
直接请求(强制性浏览)
Vulnerability Title
InnoShop 安全漏洞
Vulnerability Description
InnoShop是InnoShop开源的一个基于 Laravel 11 的开源电子商务系统。 InnoShop 0.4.1及之前版本存在安全漏洞，该漏洞源于前端商店多处存在不安全的直接对象引用，可能导致泄露其他客户个人信息和删除产品评论。
CVSS Information
N/A
Vulnerability Type
N/A