CVE-2025-12919 Details
Description
A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability allowing unauthorized access to sensitive order information has been identified in EverShop versions through 2.0.1. This Insecure Direct Object Reference (IDOR) vulnerability exists in the Order Handler component, specifically within the GraphQL query resolver for orders. The issue arises because the resolver accepts an order UUID without proper authentication or authorization checks, allowing any unauthenticated user to access detailed order information, including personal customer data, shipping and billing addresses, and purchase history.
Users are advised to implement authentication and authorization checks in the order query resolver. For guest checkout scenarios, a secure token mechanism can be introduced to validate access to order information.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md | [email protected] | ExploitThird Party Advisory |
| https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.331639 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.331639 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.680788 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-99 | Improper Control of Resource Identifiers ('Resource Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| evershop evershop | <= 2.0.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Dec 11, 2025 | Initial Analysis | [email protected] |
| Nov 14, 2025 | CVE Modified | CISA-ADP |
| Nov 9, 2025 | New CVE Received | [email protected] |