ShopXO V6.7.1 Unauthenticated Cron Endpoint Leads to Business-Logic Tampering

Vulnerability Overview Vulnerability Name: Gong Fuxiang ShopXO V6.7.1 app/api/controller/Crontab.php Unauthenticated Cron Endpoint Trigger leads to Forced Order Confirmation and Business-Logic Tampering Vulnerability Type: Missing Authorization on Cron task endpoints leading to Business-Logic Tampering (CWE-862 + CWE-840) Root Cause: A pre-authentication business logic tampering vulnerability was identified in the file. Four endpoints were designed to be invoked by the OS cron scheduler but are exposed as standard HTTP routes without requiring any authentication, signature tokens, or source IP whitelisting. The parent controller only calls to populate and does not enforce login; the helper method is defined in the parent class but is never called from . The four Crontab operation methods carry per-method access annotations , but lack manual calls or equivalent gating mechanisms. The downstream service layer also performs no caller verification—there are no cron-only token checks, no source IP whitelisting, and no rate limiting; the methods execute their encapsulated database write operations unconditionally. Impact Scope Affected Product: ShopXO Version: V6.7.1 Software Link: https://github.com/gongfuxiang/shopxo/releases/tag/v6.7.1 Impact: Exploiting this vulnerability allows an unauthenticated remote attacker to invoke production cron tasks via a single HTTP GET request. The most severe endpoint is , which targets all orders where is earlier than the configured "auto-confirm" window (default 15 days) and (shipped, awaiting buyer confirmation), atomically converting them to (completed) while triggering four downstream side effects: granting points/loyalty points, incrementing product sales counts, distributing system messages to buyers, and logging order history. Actual impacts include: (a) Buyers are deprived of the statutory 7-day no-reason return/dispute window because their orders are forcibly marked as "completed"; (b) Merchants' promotional point releases occur prematurely, disrupting accounting for campaigns; (c) Product sales statistics and historical order logs are polluted by attacker-triggered events that appear to originate from legitimate buyer users (operator user ID=0). System messages such as "Your order has been confirmed" are pushed to buyers, providing a credible narrative for unauthorized state changes. Companion endpoints (batch closing overdue unpaid orders/rolling back inventory), (closing overdue payment logs), and (prematurely granting goods-bound points) provide an additional attack surface targeting merchant rights and buyer protections, as well as lightweight DoS primitives via repeated invocation. Remediation Immediately take corrective measures to protect buyer rights and maintain merchant operational integrity. Ensure all Cron task endpoints are invoked solely through the OS cron scheduler and are not exposed as standard HTTP routes. Implement appropriate authorization mechanisms, such as per-method access annotations, manual calls, or equivalent gating. Enforce caller verification at the service layer, including cron-only token checks, source IP whitelisting, and rate limiting. POC Code Exploitation Code Vulnerability Request Packet Database Pre-state, Unauthenticated Request, and Post-state Screenshots !Database Pre-state !Unauthenticated Request !Database Post-state --- The above is a summary of the key vulnerability information.

Goal Reached Thanks to every supporter — we hit 100%!

ShopXO V6.7.1 Unauthenticated Cron Endpoint Leads to Business-Logic Tampering

More from this source