CVE-2026-105571

PickMall Lilishop Mobile Binding bindMobile improper authorization

View on CVE.org
Published Oct 6, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

A flaw exists in PickMall Lilishop up to version 4.2.4 within the bindMobile function of the Mobile Binding component. Manipulation of the Username argument bypasses the authorization checks, allowing an attacker to impersonate any user. This flaw is a classic example of improper authorization (CWE‑266, CWE‑285) and can result in unauthorized access to a user’s account, potential data theft, and elevated privileges. The vulnerability is remotely exploitable and an exploit has already been released, giving attackers an easy path to gain unauthorized access.

Affected Systems

The affected product is PickMall Lilishop, all releases up to and including 4.2.4 are vulnerable. No other vendor or product versions are listed as affected.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity due to the potential for remote exploitation and unauthorized access. EPSS data is not available and the vulnerability is not yet listed in the CISA KEV catalog. The attack can be launched over the network by sending a crafted request to the /buyer/passport/member/bindMobile endpoint. Because the flaw resides in a public API, no special conditions are required beyond network access. Although no active exploitation reports exist, the availability of a public exploit makes immediate action advisable.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PickMall Lilishop to a version released after 4.2.4 that addresses the improper authorization flaw.
  • If an immediate upgrade is not possible, modify the bindMobile endpoint to enforce that the Username parameter cannot be overridden and that only authenticated and authorized sessions may execute this operation.
  • Enable logging and intrusion detection for unusual bindMobile requests, blocking or alerting on patterns that indicate unauthorized binding attempts.

Generated by OpenCVE AI on October 6, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Pickmall
Pickmall lilishop
Vendors & Products Pickmall
Pickmall lilishop
Type Values Removed Values Added
Description A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title PickMall Lilishop Mobile Binding bindMobile improper authorization
First Time appeared Pickmall Lilishop
Pickmall Lilishop pickmall Lilishop
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:pickmall_lilishop:pickmall_lilishop:*:*:*:*:*:*:*:*
Vendors & Products Pickmall Lilishop
Pickmall Lilishop pickmall Lilishop
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 8, 2026, 2:41 AM
Reserved
Oct 5, 2026, 4:09 PM

View source JSON

Updated
Oct 8, 2026, 2:41 AM

JSON

Status
Deferred
Published
Oct 6, 2026, 2:17 AM
Modified
Oct 8, 2026, 3:16 AM

View source JSON

No data.

Updated
Oct 6, 2026, 8:30 PM

JSON