PT-2025-26591 · Innoshop · Innoshop

The_Hiker · Published 2025-06-23 · Updated 2025-06-23 · CVE-2025-52920

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Innoshop versions 0.4.1 and earlier

Description: The issue allows for Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. This can be exploited by creating a customer account, allowing an attacker to disclose the personally identifiable information (PII) of other customers and delete their product reviews. Specifically, an attacker can view order details by browsing to "/en/account/orders/ ORDER ID " or manipulate the shipping address id and billing address id parameters to use other customers' address and billing information when making an order. Additionally, an attacker can delete other users' reviews by sending a DELETE request to "/en/account/reviews/ REVIEW ID".

Recommendations: For Innoshop versions 0.4.1 and earlier, as a temporary workaround, consider restricting access to the /en/account/orders/ ORDER ID endpoint and validating the shipping address id and billing address id parameters to prevent unauthorized access and manipulation. Also, restrict the ability to send DELETE requests to /en/account/reviews/ REVIEW ID to authorized users only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2025-52920

Affected Products

Innoshop

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-52920 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52920 · Vendor Advisory
• https://github.com/innocommerce/innoshop · Note
• https://t.me/cvetracker/26828 · Telegram Post
• https://twitter.com/CVEnew/status/1937116048685232634 · Twitter Post
• https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f · Note