PT-2025-40399 · Unknown · Yoshop 2.0

Zywac · Publicado 2025-10-02 · Atualizado 2025-10-07 · CVE-2025-56161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions YOSHOP 2.0

Description The software allows unauthorized disclosure of information through comment-list API endpoints within the Goods module. The Comment model loads the related User model without filtering specific fields. Due to the absence of $hidden or $visible attributes in the User.php file, sensitive data, including bcrypt password hashes, mobile numbers, pay money, and expend money, are exposed in JSON responses. The API endpoints vary depending on the deployment, such as /api/goods.pinglun/list, but all utilize the same vulnerable model logic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-56161

Produtos afetados

Yoshop 2.0

Referências · 7

• 🔥 https://github.com/ZyWAC/CVE-Disclosures/blob/6b337a44934ffe948275995e9b79158e97c78fc4/2025/YOSHOP2.0/CVE-2025-56161.md · Exploit
• https://t.me/CVEtracker/33956 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-56161 · Aviso do Fabricante
• https://gitee.com/xany/yoshop2.0 · Nota
• https://twitter.com/CVEnew/status/1973784633318789320 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-56161 · Nota de Segurança
• https://t.me/cveNotify/137703 · Publicação no Telegram