BeikeShop vulnerabilities

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.

In BeikeShop up to version 1.6.0.22, an SQL injection vulnerability was found in the file beike/Admin/Routes/admin.php within the Admin Design Builder Endpoint. Manipulating the settings.value argument allows remote attack. The exploit is publicly available.

BeikeShop up to version 1.6.0.22 has an improper authorization vulnerability in the Stripe Plugin component in StripeController.php via the Request argument. The attack can be performed remotely, and the exploit is publicly available. A patch is available at commit 6719e0fc.