CVE-2025-56161: Firefly Mall: hassas bilgi ifşası

Açıklama (NVD)

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields (bcrypt password hash, mobile number, pay_money, expend_money.) are exposed in JSON responses. Route names vary per deployment (e.g. /api/goods.pinglun/list), but all call the same vulnerable model logic.

Özet bilgiler

Ürün

Yiovo Firefly Mall

CVSS v3.1

7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

%0,54 (yüzdelik 45)

CWE

CWE-200

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• gitee.com
• github.com
• CWE-200