Critical · published July 12, 2024
🚨 An authentication bypass vulnerability in MStore API could let attackers log in as anyone, including admins, with just a phone number! 🔥 Think of it as someone sneaking into a party by simply reciting a friend's phone number at the door — no ID check needed! The security is trusting the wrong verification without a second glance, letting anyone walk right in. This vulnerability is absolutely devastating! An attacker could log in as any user on the site, potentially gaining admin access and wreaking havoc. They could change settings, manipulate user data, or even create new accounts with default privileges — a nightmare scenario for site security!
Think of it as someone sneaking into a party by simply reciting a friend's phone number at the door — no ID check needed! The security is trusting the wrong verification without a second glance, letting anyone walk right in. The authentication bypass exists because the 'phone' parameter in the 'firebase_sms_login' functions isn't properly verified, allowing unauthorized access to accounts if the attacker knows an email or phone number.
This vulnerability is absolutely devastating! An attacker could log in as any user on the site, potentially gaining admin access and wreaking havoc. They could change settings, manipulate user data, or even create new accounts with default privileges — a nightmare scenario for site security! Patch to version 4.14.8 or later immediately to close this critical hole. Additionally, review your access controls and consider implementing stricter verification for sensitive functions. Don't leave your site open to these sneaky intruders! You've got this! Take these steps and you'll have your site secure and under control in no time. 🛡️