Technical impact
The vulnerability resides in the InstallServiceProvider::boot function of innocommerce InnoShop’s Installation Endpoint, where authentication checks are bypassed. As a result, an attacker can remotely gain unauthorized access to the system, potentially executing arbitrary actions. The flaw is categorized as CWE-287 and carries a CVSS score of 6.9, indicating moderate to high severity.
Affected Systems
The flaw affects transactions processed by the innocommerce InnoShop component, specifically versions up to 0.7.8. Users of the "innocommerce:InnoShop" product within that version range are at risk if they have the installation endpoint exposed to untrusted networks.
Risk and Exploitability
The EPSS score is not available, so exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible, and the attack vector is likely through direct HTTP requests to the installation endpoint. An attacker who can reach the endpoint can trigger the boot function without authenticating, thereby compromising system integrity and confidentiality. The CVSS score of 6.9 reflects the threat of unauthorized access but does not indicate remote code execution; it largely depends on the actions an attacker can perform post-bypass.
