Insecure Direct Object Reference in Innoshop Affects User Privacy and Data Integrity

CVE-2025-52920

What is CVE-2025-52920?

The vulnerability in Innoshop version 0.4.1 allows attackers to exploit Insecure Direct Object Reference (IDOR) flaws at various points on the frontend of the shop. This security issue enables unauthorized users to create customer accounts and access sensitive personal information, including the ability to view order details by manipulating URL parameters. Furthermore, the vulnerability allows attackers to misuse shipping and billing information during transactions, leading to potential fraud. Additionally, an attacker can delete reviews left by other users by issuing a simple DELETE request targeting specific review IDs, further undermining the site's data integrity and the trust of its users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References