An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
The vulnerability results from improper privilege management (CWE-269) in the updateAddress method of the Address Controller class. A remote attacker can send a specially crafted request to the mentioned endpoint without needing to have any permissions, resulting in unauthorized privilege escalation in the application.
An attacker can obtain a higher level of privileges in the application, which in practice may lead to complete system takeover, disclosure of sensitive data, and modification or deletion of application data.
Apply patches available from the vendor according to references. It is recommended to update to a version higher than 1.1, restrict access to the application at the network level, and monitor traffic directed to Address Controller class endpoints.
Exrick Xmall version 1.1 and all earlier versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExrick Xmall
APPExrick1.1
Related vulnerabilities
ObejΕcie uwierzytelnienia w Exrick Xmall v1.1 poprzez crafted GET request
SQL Injection w Exrick XMall przez parametr orderDir
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access oth...
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-suppl...
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET para...