Description
Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| isotope | isotope-core | ≤ 2.9.10 | — |
References
- GitHub Issue #2585 issue-tracking
- https://github.com/isotope/core product
- Order::generateUniqueId() returns uniqid() at 2.9.10 technical-description
- OrderDetails::getCollection() ownership check is conditional on member > 0 at 2.9.10 technical-description
- VulnCheck Advisory: Isotope eCommerce through 2.9.10 Weak Order Identifier Generation third-party-advisory