CVE-2023-36331

Published: Jan 12, 2026Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

Affected (1)

Products: Exrick: Xmall

Exrick

1 product

Xmall

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Exrick Xmall	Version 1.1

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

https://github.com/Exrick/xmall/issues/100

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.