An insecure direct object reference flaw in the AfterSale controller and logic files allows an authenticated user to supply arbitrary after‑sale identifiers and obtain details, refund status, and order information that belong to other customers. The attacker can also invoke actions that cancel refunds, overwrite return shipment details, or re‑open refused refunds, potentially causing financial loss and data integrity issues. The weakness is classified as CWE‑639 – Insecure Direct Object Reference.

The flaw affects all installations of Likeshop version 3.5.1 and earlier. The specific components impacted are the AfterSale.php API controller and AfterSaleLogic.php logic layer within the server application. Operators should verify that their deployment does not use a supported (non‑3.5.1) branch of the repository.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. The likely attack vector is that an attacker with a valid user account submits specially crafted request parameters to the AfterSale API endpoints; no special privilege or arbitrary code execution is required.