Beikeshop
Monthly
Guest order records in BeikeShop through 2.0.0.31 can be looked up by order number without proving the requester is the guest who placed the order, letting unauthenticated remote attackers read order details and, where the PayPal plugin is active, reach PayPal create/capture flows for orders that are not theirs. The flaw sits in OrderRepo::getOrderByNumber, which returns a guest order (customer_id null) on the strength of the order_number argument alone; the CVSS 4.0 score is 6.9 with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, so no credentials or user interaction are needed. Guest checkout must be in use on the target store and the attacker needs valid or guessable order numbers; a fix ships in 2.0.0.32 and no public exploit has been identified at time of analysis.
BeikeShop through 2.0.0.31 contains an insecure direct object reference (IDOR) in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' return shipping details. By submitting sequential RMA IDs to the account/rmas/{id}/mark_as_shipped endpoint, an attacker with a valid customer account can overwrite courier names and tracking numbers and mark approved returns as shipped. The vendor CVSS 4.0 base score is 5.3 (PR:L, VI:L), matching an independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N; no public exploit code has been identified at the time of analysis, though a technical write-up is available.
Improper authorization in the BeikeShop e-commerce platform (versions up to 1.6.0.22) allows remote unauthenticated attackers to forge Stripe payment webhook callbacks and mark unpaid orders as paid. The flawed `callback` function in `plugins/Stripe/Controllers/StripeController.php` accepts arbitrary request bodies without verifying the Stripe-Signature header, and publicly available exploit code exists on GitHub. CVSS is 7.3 with EPSS not provided; the issue is not in CISA KEV but has a public POC, raising the practical risk for any internet-exposed BeikeShop store.
A vulnerability was identified in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Guest order records in BeikeShop through 2.0.0.31 can be looked up by order number without proving the requester is the guest who placed the order, letting unauthenticated remote attackers read order details and, where the PayPal plugin is active, reach PayPal create/capture flows for orders that are not theirs. The flaw sits in OrderRepo::getOrderByNumber, which returns a guest order (customer_id null) on the strength of the order_number argument alone; the CVSS 4.0 score is 6.9 with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, so no credentials or user interaction are needed. Guest checkout must be in use on the target store and the attacker needs valid or guessable order numbers; a fix ships in 2.0.0.32 and no public exploit has been identified at time of analysis.
BeikeShop through 2.0.0.31 contains an insecure direct object reference (IDOR) in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' return shipping details. By submitting sequential RMA IDs to the account/rmas/{id}/mark_as_shipped endpoint, an attacker with a valid customer account can overwrite courier names and tracking numbers and mark approved returns as shipped. The vendor CVSS 4.0 base score is 5.3 (PR:L, VI:L), matching an independent assessment of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N; no public exploit code has been identified at the time of analysis, though a technical write-up is available.
Improper authorization in the BeikeShop e-commerce platform (versions up to 1.6.0.22) allows remote unauthenticated attackers to forge Stripe payment webhook callbacks and mark unpaid orders as paid. The flawed `callback` function in `plugins/Stripe/Controllers/StripeController.php` accepts arbitrary request bodies without verifying the Stripe-Signature header, and publicly available exploit code exists on GitHub. CVSS is 7.3 with EPSS not provided; the issue is not in CISA KEV but has a public POC, raising the practical risk for any internet-exposed BeikeShop store.
A vulnerability was identified in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was determined in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.5.5. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.