Likeshop

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.

Published: 2026-10-15T21:43:39.350Z
Updated: 2026-10-21T01:46:15.633Z

A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin of the component Merchandise Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-267449 was assigned to this vulnerability.

Published: 2024-06-08T12:00:06.623Z
Updated: 2024-09-03T17:44:37.925Z

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can bypass account lockout mechanisms during attempts to log into admin accounts, spoof IP addresses in requests sent to the server, and impersonate IP addresses that have logged into user accounts, etc.

Published: 2024-08-07T00:00:00.000Z
Updated: 2024-08-07T17:31:22.277Z

SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList function, exploited at the /admin/order/lists.html endpoint.

Published: 2024-05-20T17:47:50.073Z
Updated: 2025-02-13T15:53:44.053Z

Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.

Published: 2024-02-29T00:00:00.000Z
Updated: 2024-11-07T21:30:41.173Z