PickMall Lilishop Authorization and Access Control Flaws

Improper authorization in PickMall Lilishop 4.2.4 and earlier allows remote attackers to tamper with the mobile-number binding workflow at /buyer/passport/member/bindMobile by manipulating the Username argument, bypassing intended ownership checks (CWE-285). Publicly available exploit code exists but there is no confirmed active exploitation (not in CISA KEV). The vendor-assigned CVSS 4.0 base score is 5.5, while independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, noting that although the scored vector claims PR:N, the buyer/passport endpoint path strongly suggests a valid buyer session is realistically required to reach the vulnerable function, so the PR:N assumption should be verified against the application's authentication flow.

An authenticated authorization bypass in PickMall Lilishop 4.2.4 and earlier allows any buyer-level user to read other members' invoice/receipt data by manipulating the memberId parameter on the /buyer/trade/receipt endpoint. Publicly available exploit code exists, and the vendor has not responded to the reported issue, but the vulnerability only exposes limited invoice information (low confidentiality impact) and requires a valid buyer session, so it does not warrant emergency prioritization.