PT-2026-2300 · Xmall · Xmall

Published 2026-01-12 · Updated 2026-01-12 · CVE-2023-36331

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions xmall version 1.1

Description An issue exists in xmall version 1.1 related to access control. Specifically, the /member/orderList API endpoint allows unauthorized access to other users' order details. This is achieved by manipulating the userId query parameter. The API endpoint /member/orderList is vulnerable. The userId parameter is susceptible to manipulation.

Recommendations Apply appropriate access controls to the /member/orderList API endpoint to prevent unauthorized access to order details. Ensure the userId parameter is properly validated to restrict access to only the intended user's order information.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-36331

Affected Products

Xmall

References · 5

• 🔥 https://github.com/Exrick/xmall/issues/100 · Exploit
• https://osv.dev/vulnerability/CVE-2023-36331 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36331 · Security Note
• https://twitter.com/CVEnew/status/2010809151325085759 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2010814498089673156 · Twitter Post