Exrick
Monthly
Authenticated low-privileged users in Exrick XBoot through 3.3.4 can bypass role-based data-scope restrictions and read user records from any department by sending GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department IDs. The endpoint fails to enforce the data-scope filter, exposing usernames, real names, mobile numbers, emails, and account status (CWE-639 IDOR). The flaw has a moderate CVSS 3.1 score of 5.3 (medium) and requires only a valid session (PR:L, no user interaction); no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Exrick XBoot through 3.3.4 allows any authenticated user to defeat server-side role data-scope restrictions by appending the parameter openDataFilter=false to the department getByParentId or search endpoints, causing the API to return the entire organization's department tree and names outside the caller's assigned scope. The underlying flaw is an improper-authorization condition (CWE-863) rated medium severity (CVSS 5.3, CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L), and the impact is limited to organizational-structure disclosure - no credential exposure, data modification, or availability effect. Exploitation requires a valid logged-in XBoot account whose role carries data-scope restrictions (PR:L); no public exploit code was identified at time of analysis, although a public technical write-up of the bypass and the vulnerable source code are both referenced in the advisory data.
Reflected or stored cross-site scripting in the Order Printing component of Exrick xmall allows remote attackers to inject malicious scripts into victim browsers via the order-print.jsp template. The affected file is xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp, which fails to sanitize user-controlled input before rendering it in HTML context. Successful exploitation requires victim interaction (e.g., a privileged user viewing or printing a crafted order), making this a realistic attack against administrative personnel in e-commerce deployments using this platform.
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId. [CVSS 8.2 HIGH]
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability was found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Authenticated low-privileged users in Exrick XBoot through 3.3.4 can bypass role-based data-scope restrictions and read user records from any department by sending GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department IDs. The endpoint fails to enforce the data-scope filter, exposing usernames, real names, mobile numbers, emails, and account status (CWE-639 IDOR). The flaw has a moderate CVSS 3.1 score of 5.3 (medium) and requires only a valid session (PR:L, no user interaction); no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Exrick XBoot through 3.3.4 allows any authenticated user to defeat server-side role data-scope restrictions by appending the parameter openDataFilter=false to the department getByParentId or search endpoints, causing the API to return the entire organization's department tree and names outside the caller's assigned scope. The underlying flaw is an improper-authorization condition (CWE-863) rated medium severity (CVSS 5.3, CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L), and the impact is limited to organizational-structure disclosure - no credential exposure, data modification, or availability effect. Exploitation requires a valid logged-in XBoot account whose role carries data-scope restrictions (PR:L); no public exploit code was identified at time of analysis, although a public technical write-up of the bypass and the vulnerable source code are both referenced in the advisory data.
Reflected or stored cross-site scripting in the Order Printing component of Exrick xmall allows remote attackers to inject malicious scripts into victim browsers via the order-print.jsp template. The affected file is xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp, which fails to sanitize user-controlled input before rendering it in HTML context. Successful exploitation requires victim interaction (e.g., a privileged user viewing or printing a crafted order), making this a realistic attack against administrative personnel in e-commerce deployments using this platform.
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId. [CVSS 8.2 HIGH]
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability was found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Exrick xboot up to 3.3.4. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.