-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bagisto/bagisto | composer | < 2.3.10 | 2.3.10 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the reorder method within the OrderController.php file. The security advisory and the commit patch b2b1cf62577245d03a68532478cffbe321df74d3 confirm this. The original code fetched an order solely by its ID (findOrFail($id)), failing to check if the order belonged to the currently authenticated customer. This allowed any authenticated user to access and reorder items from another user's order by simply changing the order ID in the URL. The patch rectifies this by adding a where clause to the database query, ensuring that the customer_id of the retrieved order matches the ID of the logged-in customer.
Webkul\Shop\Http\Controllers\Customer\Account\OrderController::reorderpackages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php