PrestaShop pgdpr/blockwishlist IDOR Vulnerability Analysis & PoC

Vulnerability Report Summary Vulnerability Overview Finding 1: The module (GDPR compliance module, version 1.4.3) contains an IDOR vulnerability, allowing authenticated customers to forge GDPR consent records for arbitrary customers. Finding 2: The module (version 3.0.2) contains an IDOR vulnerability, where missing authorization checks allow the wishlist share token of other customers to be leaked. Impact Finding 1: Any authenticated customer can insert GDPR consent audit log entries belonging to others, polluting the GDPR activity logs in the admin panel. Finding 2: Any authenticated customer can enumerate wishlist IDs and collect share tokens, thereby reading other customers' saved product lists and leaking their shopping intentions. Remediation Finding 1: Validate that the in the query parameter matches the current session customer. Finding 2: Add at the top of , consistent with other actions. POC Code Finding 1 POC POC Steps: 1. The attacker authenticates and obtains (exposed in the query parameter). 2. The attacker submits a forged consent for the victim ( ): 3. The forged entry appears in the admin panel's GDPR > Customer Activity list. Finding 2 POC POC Steps: 1. The victim creates a wishlist (normal usage): 2. The attacker calls passing the victim's wishlist ID: 3. The response returns the plaintext token: 4. The attacker can view the victim's wishlist without logging in: Verification Environment All verified against PrestaShop 9.1.1 on a local Docker instance.

Goal Reached Thanks to every supporter — we hit 100%!

PrestaShop pgdpr/blockwishlist IDOR Vulnerability Analysis & PoC

More from this source