abdullahalmutawa/cve-2024-50945SimplCommerce is affected by a Broken Access Control vulnerability in the review system, allowing unauthorized users to post reviews for products they have not purchased.
SimplCommerce is affected by a Broken Access Control vulnerability in the review system, allowing unauthorized users to post reviews for products they have not purchased.
An attacker can detect this vulnerability by sending a request to the review submission endpoint and changing the EntityId to the ID of a product they have not purchased. If the review is successfully posted, it confirms the website is vulnerable to Broken Access Control vulnerability.
230310c8d7a0408569b292c5a805c459d47a1d8f commit
https://www.simplcommerce.com/
https://github.com/simplcommerce/SimplCommerce
https://github.com/simplcommerce/SimplCommerce/issues/1112
Abdullah Almutawa
