Sylius vulnerabilities

Sylius, an open-source eCommerce framework on Symfony, contains a vulnerability in versions from 2.0.0 to 2.0.17, 2.1.14, and 2.2.5. The GET and PUT API endpoints for payment requests do not verify resource ownership based on the hash, allowing an attacker to read payment and order data and modify redirect fields. A similar issue affects payment creation, where order ownership is not checked.

Sylius, an Open Source eCommerce Framework on Symfony, contains an authorization bypass vulnerability in the shop account API. The PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint does not validate that the chosen payment method is enabled for the order's channel, allowing an authenticated customer to assign any globally enabled payment method to their order, including methods excluded by the store operator.

Sylius, an Open Source eCommerce Framework on Symfony, contains an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order's changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order.