CoreShop vulnerabilities

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.

CoreShop versions 5.0.1 through 5.1.0-beta.1 have a GitHub Actions workflow vulnerability allowing external attackers to achieve RCE by submitting a malicious Pull Request. The workflow uses `pull_request_target` and dangerously checks out code from the PR head.

CoreShop prior to version 4.1.8 contains a blind SQL injection vulnerability that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.