| عنوان | jishenghua https://github.com/jishenghua/jshERP <=3.5 IDOR(arbitrary admin count add) |
|---|
| الوصف | A high-risk IDOR vulnerability has been discovered in the latest version (v3.5). After logging in with a low-privilege role account, users can send requests to the /jshERP-boot/user/addUser endpoint to create new accounts, including high-privilege accounts and accounts with custom permissions assigned to other groups. This functionality should only be accessible to system administrators, but due to insufficient access control, it is exposed to unauthorized users. |
|---|
| المصدر | ⚠️ https://github.com/jishenghua/jshERP/issues/125 |
|---|
| المستخدم | ez-lbz (UID 87033) |
|---|
| ارسال | 25/07/2025 04:32 PM (1 سنة منذ) |
|---|
| الاعتدال | 10/08/2025 01:31 PM (16 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 319373 [jshERP حتى 3.5 Endpoint addUser تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|