PT-2025-45581 · Evershop · Evershop

Ictrun + 1 · Published 2025-11-09 · Updated 2025-12-11 · CVE-2025-12919

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EverShop versions up to 2.0.1

Description A flaw exists in EverShop related to improper control of resource identifiers. The issue is located in an unknown function within the /src/modules/oms/graphql/types/Order/Order.resolvers.js file of the Order Handler component. Manipulation of the uuid argument can trigger the issue. The attack can be performed remotely and is considered to have high complexity and difficult exploitability. The exploit is publicly available. The vendor was contacted but did not respond.

Recommendations Versions prior to 2.0.1 should be updated.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-99

Related Identifiers

CVE-2025-12919

GHSA-C73G-MX2W-CC93

Affected Products

Evershop

References · 14

• 🔥 https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps · Exploit
• 🔥 https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12919 · Security Note
• https://osv.dev/vulnerability/GHSA-c73g-mx2w-cc93 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12919 · Vendor Advisory
• https://github.com/evershopcommerce/evershop · Note
• https://twitter.com/VulmonFeeds/status/1987617560452346049 · Twitter Post
• https://twitter.com/CVEnew/status/1987619482894782876 · Twitter Post
• https://t.me/CVEtracker/36876 · Telegram Post
• https://t.me/cveNotify/142224 · Telegram Post
• https://vuldb.com/?ctiid.331639 · Note
• https://vuldb.com/?id.331639 · Note
• https://t.me/cveNotify/145527 · Telegram Post
• https://vuldb.com/?submit.680788 · Note