| عنوان | fuyang_lipengjun platform v1.0 broken function level authorization |
|---|
| الوصف | PoC (Proof of Concept):
Log in to the application with any user account, including those with low privileges.
Send a GET request to the endpoint http://host/attribute/queryAll.
The server returns a complete list of attribute information. This data should typically be restricted to users with administrative privileges.
Effect: The queryAll method in the AttributeController class lacks any permission checks. This allows any authenticated user, regardless of their assigned roles or permissions, to access the list of all attribute data, leading to unauthorized information disclosure. |
|---|
| المصدر | ⚠️ https://www.cnblogs.com/aibot/p/19063430 |
|---|
| المستخدم | lucasg2g (UID 84737) |
|---|
| ارسال | 12/09/2025 10:48 AM (8 أشهر منذ) |
|---|
| الاعتدال | 18/09/2025 07:52 AM (6 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 324796 [fuyang_lipengjun platform 1.0 /attribute/queryAll AttributeController تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|