PickMall Lilishop CVE-2026-105571

Exploitation targets the Mobile Binding component specifically via the /buyer/passport/member/bindMobile function in PickMall Lilishop versions up to and including 4.2.4; the attacker manipulates the Username argument to trigger the improper authorization condition. The CVSS vector asserts no privileges and no user interaction (PR:N/UI:N) over the network, but the 'passport/buyer' endpoint path strongly implies a buyer session or authentication context is normally required, so realistic exploitation likely needs at least a valid buyer account to invoke the endpoint - this PR:N assumption should be verified against the application's authentication flow. No special non-default configuration is indicated; the limiting factors are the specific vulnerable version range (≤4.2.4) and the probable need for an authenticated buyer context to reach the function.

This is a moderate-severity improper authorization flaw (CWE-285) with a VulDB-assigned CVSS 4.0 base score of 5.5. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity exploitation with no privileges or user interaction, but impact is uniformly LOW across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), consistent with a single authorization bug on the mobile-binding function rather than a full account takeover or RCE. The 4.0 vector carries E:P (Proof-of-Concept), and the input confirms publicly available exploit code, so a working attack path is reachable - but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated real-world exploitation. Signals are therefore internally consistent (network-reachable PoC, low blast radius) but modest: this reads as a real, verifiable weakness worth patching in affected deployments, not an emergency-priority issue. Two caveats temper the raw vector: (1) the endpoint path /buyer/passport/member/bindMobile implies a buyer-session/passport context, which conflicts with PR:N - the 'improper authorization' framing suggests an authenticated or semi-authenticated user escalating authority rather than a fully anonymous attacker, so the PR:N rating should be verified; (2) the entire analysis rests on a single source (VulDB) with no independent vendor confirmation, as the project has not responded to the issue report.

A remote attacker reaches the /buyer/passport/member/bindMobile endpoint of the Mobile Binding component and manipulates the Username argument, exploiting missing authorization checks to bind or alter a mobile number against an account the attacker should not control. Published exploit code exists (VulDB / the project's GitHub issue #148), lowering the barrier to reproduction. Because CVSS impact is rated LOW across C/I/A, the realistic outcome is limited unauthorized data or account-attribute manipulation rather than full compromise.