A flaw exists in PickMall Lilishop up to version 4.2.4 within the bindMobile function of the Mobile Binding component. Manipulation of the Username argument bypasses the authorization checks, allowing an attacker to impersonate any user. This flaw is a classic example of improper authorization (CWE‑266, CWE‑285) and can result in unauthorized access to a user’s account, potential data theft, and elevated privileges. The vulnerability is remotely exploitable and an exploit has already been released, giving attackers an easy path to gain unauthorized access.

The affected product is PickMall Lilishop, all releases up to and including 4.2.4 are vulnerable. No other vendor or product versions are listed as affected.

The CVSS score of 6.9 indicates moderate severity due to the potential for remote exploitation and unauthorized access. EPSS data is not available and the vulnerability is not yet listed in the CISA KEV catalog. The attack can be launched over the network by sending a crafted request to the /buyer/passport/member/bindMobile endpoint. Because the flaw resides in a public API, no special conditions are required beyond network access. Although no active exploitation reports exist, the availability of a public exploit makes immediate action advisable.