| عنوان | feiyuchuixue https://github.com/feiyuchuixue/sz-boot-parent sz-boot-parent <= v1.3.2-beta IDOR |
|---|
| الوصف | The API endpoint /api/admin/sys-message/{messageId} contains a critical security flaw that permits unauthorized malicious enumeration of the dynamic messageId path parameter, enabling any unauthenticated or low-privilege user to iterate through sequential or predictable messageId values and improperly access, view, and retrieve the private and sensitive message content belonging to other legitimate users within the system without any proper access control or authorization validation in place. |
|---|
| المصدر | ⚠️ https://github.com/yuccun/CVE/blob/main/sz-boot-parent-IDOR_Message_ID_Enumeration.md |
|---|
| المستخدم | yuccun (UID 93614) |
|---|
| ارسال | 07/02/2026 07:48 PM (8 أشهر منذ) |
|---|
| الاعتدال | 25/02/2026 09:32 AM (18 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 347743 [feiyuchuixue sz-boot-parent حتى 1.3.2-beta API Endpoint /api/admin/sys-message/ messageId تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|