Mall4Cloud
Monthly
Mall4cloud through 4.0 allows an authenticated merchant to read other shops' buyer shipping addresses by enumerating sequential orderAddrId values through GET /m/order/order_addr/{orderAddrId}, exposing consignee names, mobile numbers, addresses, and post codes. The flaw is an insecure direct object reference (CWE-639) in the multishop OrderController getOrderAddr handler, which serves records without an ownership or tenant check. Exploitation requires a valid merchant account and use of the multishop order module, so the realistic threat population is registered sellers rather than anonymous internet users; no public exploit identified at time of analysis, no CISA KEV active exploitation is noted, and the signals are moderately consistent but point to a targeted, not mass-exploitation, profile.
Mall4cloud through 4.0 allows an authenticated merchant to read other shops' buyer shipping addresses by enumerating sequential orderAddrId values through GET /m/order/order_addr/{orderAddrId}, exposing consignee names, mobile numbers, addresses, and post codes. The flaw is an insecure direct object reference (CWE-639) in the multishop OrderController getOrderAddr handler, which serves records without an ownership or tenant check. Exploitation requires a valid merchant account and use of the multishop order module, so the realistic threat population is registered sellers rather than anonymous internet users; no public exploit identified at time of analysis, no CISA KEV active exploitation is noted, and the signals are moderately consistent but point to a targeted, not mass-exploitation, profile.