CVE-2024-50654
Last modified
CVE-2024-50654 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the data packets for coupon collection in high concurrency.. EPSS estimates a 1.56% chance of exploitation in the next 30 days.
Description
lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturing and sending the data packets for coupon collection in high concurrency.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pickmall | Lilishop | <= 4.2.4 |
References
- https://github.com/Yllxx03/CVE/blob/main/lilishop/CouponLogicVulnerability.mdExploit, Third Party Advisory
- https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50654Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-50654?
How severe is CVE-2024-50654?
How do I fix CVE-2024-50654?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-50649The user avatar upload function in python_book V1.0 has an a…9.8
- CVE-2024-5065A vulnerability classified as critical has been found in PHP…9.8
- CVE-2024-50650python_book V1.0 is vulnerable to Incorrect Access Control, …7.5
- CVE-2024-50651java_shop 1.0 is vulnerable to Incorrect Access Control, whi…6.5
- CVE-2024-50652A file upload vulnerability in java_shop 1.0 allows attacker…4.3
- CVE-2024-50653CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Use…7.5
- CVE-2024-50655emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XS…5.4
- CVE-2024-50656itsourcecode Placement Management System 1.0 is vulnerable t…6.1
- CVE-2024-50657An issue in Owncloud android apk v.4.3.1 allows a physically…6.8
- CVE-2024-50658Server-Side Template Injection (SSTI) was found in AdPortal …9.8
- CVE-2024-50659Cross Site Scripting vulnerability iPublish Media Solutions …6.1
- CVE-2024-5066A vulnerability classified as critical was found in PHPGuruk…8.8
Are you affected by CVE-2024-50654?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST