YOSHOP 2.0 is vulnerable to an unauthenticated information disclosure flaw that exposes sensitive user credentials and financial data via the comment-list API.

This is an information disclosure vulnerability occurring when the application eagerly loads user data without restricting sensitive fields. Unauthenticated attackers can query specific API endpoints to retrieve cleartext-equivalent password hashes and personal user information.

The exposure of bcrypt password hashes and financial data poses a severe risk of account takeover and potential secondary attacks against users. Given the CVSS score of 7.5, this high-severity vulnerability could lead to significant regulatory non-compliance and loss of customer trust if user data is exfiltrated by malicious actors.

Immediate Action: Restrict access to the affected API endpoints at the network or application level until a vendor-supplied patch is available. Developers should implement strict field filtering on the User model to ensure sensitive attributes are excluded from JSON responses.

Proactive Monitoring: Monitor access logs for high-frequency or anomalous requests directed at the Goods module API endpoints. Review logs for evidence of unauthorized data harvesting attempts targeting the comment-list functionality.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or rate-limit requests to the /api/goods.pinglun/list or similar endpoints associated with the vulnerable comment-list logic.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

The risk posed by this vulnerability is significant due to the exposure of authentication-related hashes and sensitive user data. Organizations should prioritize implementing WAF filtering to prevent unauthorized access to these endpoints while awaiting an official software update from the vendor.