CVE-2024-0415 is a medium severity improper access control vulnerability in DeShang DSMall up to 6.1.0, scored CVSS 6.3. It affects application/home/controller/TaobaoExport.php through the image URL handler. The record names no fixed version, so check the vendor or project and restrict access.
What's affected
The record names DeShang DSMall, up to 6.1.0. The weakness is improper access control: a request that should be refused is allowed. The weakness is tracked as CWE-284. The affected code is application/home/controller/TaobaoExport.php, reached through the image URL handler. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-11 and the VulDB identifier is 250435.
The record links a researcher's write up, but we could not read it in usable form, and the VulDB entry is behind a bot check, so we cannot add details beyond the record.
The record does not name a fixed version. Treat the product as unpatched until the vendor or project says otherwise. It is not on the CISA Known Exploited Vulnerabilities list, and the sources we read do not report exploitation.
How to check if you're exposed
Start by finding out whether the file exists in your copy:
find /var/www -name "TaobaoExport.php"
Then read the controller to see what checks run before it fetches or processes an image URL. Look for a login check, a permission check, and any restriction on which addresses can be requested.
Review your access logs for requests to this feature, especially from accounts or addresses that should not use it. If the feature is not in use in your shop, note that for the next step.
A dependency scanner will not find a standalone application like this on its own, because it is deployed code, not a package. You can still use Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan on any project that bundles it as a library, and the Gold entry for CVE-2024-0415 tracks the record as it changes.
What to do now
- Find every deployed copy of DSMall.
- Check the vendor or project page for a fixed release. We could not confirm one.
- If you do not use the Taobao import feature, remove or block the controller route.
- If you use it, require a signed in user with the right role before any image URL is processed.
- Restrict which addresses the handler may fetch from, so it cannot reach internal services.
- Review the access logs for unexpected use of the feature.
Try it yourself
This walkthrough shows how an inventory and risk view helps you find components like this across many repositories.
Click through it at your own pace, or open it full screen.
Why it matters
Access control flaws let a request do something its sender should not be allowed to do. The record names the image URL handler, which means the controller takes a link and acts on it. Features that fetch what a user points them at need a strict check of who is asking and where they can point.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, scored 6.3 (medium). VulDB's wording classifies it as critical, which is its own label and differs from the CVSS rating. We report both so you can weigh them.
This record is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0415 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list and the sources we could read do not report exploitation. The description says a public exploit exists, so do not wait for confirmation.
Is there a fixed version of DSMall?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-0415
- NVD record for CVE-2024-0415, including VulDB entry 250435, as summarized in the Safeguard record file. We could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed.
Last reviewed: 19 October 2026.
