CVE-2025-12919
📋 TL;DR
This vulnerability in EverShop allows attackers to manipulate order UUID parameters to access unauthorized order data. It affects EverShop installations up to version 2.0.1. The attack can be performed remotely but requires high complexity to exploit.
💻 Affected Systems
- EverShop
📦 What is this software?
Evershop by Evershop
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to sensitive order information including customer data, payment details, and order history.
Likely Case
Information disclosure of order data that should be restricted to authorized users only.
If Mitigated
Minimal impact with proper access controls and input validation in place.
🎯 Exploit Status
Exploit is public but requires specific knowledge of GraphQL and UUID manipulation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading if vendor releases fix or implement workarounds.
🔧 Temporary Workarounds
Input Validation for UUID Parameters
allAdd strict validation for UUID parameters in Order resolvers to prevent unauthorized access
Modify /src/modules/oms/graphql/types/Order/Order.resolvers.js to validate UUID against authorized user permissions
Access Control Enhancement
allImplement additional authorization checks before processing order requests
Add middleware or resolver-level checks to verify user has permission to access specific order UUIDs
🧯 If You Can't Patch
- Implement WAF rules to detect and block suspicious UUID manipulation attempts
- Monitor GraphQL queries for unusual order access patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check if EverShop version is 2.0.1 or earlier and review Order.resolvers.js for proper UUID validationCheck Version:
Check package.json or application configuration for EverShop versionVerify Fix Applied:
Test that unauthorized users cannot access order data by manipulating UUID parameters📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL queries targeting order endpoints with manipulated UUIDs
- Multiple failed order access attempts
Network Indicators:
- Suspicious patterns in GraphQL API requests to order endpoints
SIEM Query:
source="application_logs" AND (message CONTAINS "Order.resolvers" OR message CONTAINS "unauthorized order access")🔗 References
- https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md
- https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps
- https://vuldb.com/?ctiid.331639
- https://vuldb.com/?id.331639
- https://vuldb.com/?submit.680788
- https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps
