Xmall Broken Access Control Vulnerability Allowing Unauthorized Access to User Orders

A broken access control vulnerability has been identified in the Xmall application, version 1.1. The issue allows authenticated users to access other users' order details by manipulating the userId query parameter in the orderList API. This vulnerability arises from inadequate validation of user permissions, enabling unauthorized access to sensitive order information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to other users' order details, causing privacy breaches and potential data manipulation.

Reproduction

To reproduce this vulnerability, log into an account and send a request to the /member/orderList API. Modify the userId parameter to target another user's ID. The response will include the order details of the specified user, demonstrating the access control flaw.