Executive brief
EverShop is an open-source e-commerce platform used to build online stores. The vulnerability allows an attacker to access order information belonging to other customers by manipulating order identifiers in API requests, potentially exposing sensitive customer data such as order details, addresses, and payment information.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in EverShop's Order Handler GraphQL resolver (Order.resolvers.js) where the uuid parameter is not properly validated. An unauthenticated attacker can manipulate the order uuid argument to access order information belonging to other customers. The attack requires high complexity and is difficult to exploit, but may be performed from the network without authentication. The vulnerability affects versions up to 2.0.1, with disclosure indicating the vendor did not respond to early notification.
Affected products
- EverShop EverShop up to 2.0.1
Timeline
- 2025-11-09: disclosed
- 2025-11-09: exploited: Exploit code published on GitHub