PT-2025-40399 · Unknown · Yoshop 2.0

Zywac · Published 2025-10-02 · Updated 2025-10-07 · CVE-2025-56161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions YOSHOP 2.0

Description The software allows unauthorized disclosure of information through comment-list API endpoints within the Goods module. The Comment model loads the related User model without filtering specific fields. Due to the absence of $hidden or $visible attributes in the User.php file, sensitive data, including bcrypt password hashes, mobile numbers, pay money, and expend money, are exposed in JSON responses. The API endpoints vary depending on the deployment, such as /api/goods.pinglun/list, but all utilize the same vulnerable model logic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-56161

Affected Products

Yoshop 2.0

References · 7

• 🔥 https://github.com/ZyWAC/CVE-Disclosures/blob/6b337a44934ffe948275995e9b79158e97c78fc4/2025/YOSHOP2.0/CVE-2025-56161.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-56161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56161 · Security Note
• https://t.me/CVEtracker/33956 · Telegram Post
• https://gitee.com/xany/yoshop2.0 · Note
• https://twitter.com/CVEnew/status/1973784633318789320 · Twitter Post
• https://t.me/cveNotify/137703 · Telegram Post