Insecure Direct Object Reference in Innoshop Affects User Privacy and Data Integrity

CVE-2025-52920

What is CVE-2025-52920?

The vulnerability in Innoshop version 0.4.1 allows attackers to exploit Insecure Direct Object Reference (IDOR) flaws at various points on the frontend of the shop. This security issue enables unauthorized users to create customer accounts and access sensitive personal information, including the ability to view order details by manipulating URL parameters. Furthermore, the vulnerability allows attackers to misuse shipping and billing information during transactions, leading to potential fraud. Additionally, an attacker can delete reviews left by other users by issuing a simple DELETE request targeting specific review IDs, further undermining the site's data integrity and the trust of its users.

References