CVE-2025-52920: Medium severity Innoshop Innoshop vulnerability
Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/ORDERID or use the address and billing information of other customers by manipulating the shippingaddressid and billingaddressid parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/REVIEWID.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52920?
CVE-2025-52920 is considered a high severity vulnerability due to its potential impact on the confidentiality and integrity of customer data.
How do I fix CVE-2025-52920?
To mitigate CVE-2025-52920, upgrade to a version of Innoshop later than 0.4.1 that addresses the IDOR vulnerability.
What systems are affected by CVE-2025-52920?
CVE-2025-52920 affects the Innoshop application version 0.4.1.
What are the potential impacts of CVE-2025-52920?
Successful exploitation of CVE-2025-52920 allows unauthorized access to personally identifiable information (PII) and the ability to delete product reviews.
Who can exploit CVE-2025-52920?
Any attacker can exploit CVE-2025-52920 by creating a customer account on the affected version of Innoshop.