| عنوان | jishenghua jshERP <=3.6 SSRF |
|---|
| الوصف | A server-side request forgery (SSRF) vulnerability exists in the WeChat integration flow. An authenticated admin user can modify platform configuration values via the /platformConfig/updatePlatformConfigByKey endpoint, setting the weixinUrl to an arbitrary URL. When WeChat login is subsequently triggered, the application makes HTTP requests to the attacker-controlled URL.
|
|---|
| المصدر | ⚠️ https://github.com/jishenghua/jshERP/issues/152 |
|---|
| المستخدم | Ana10gy (UID 93358) |
|---|
| ارسال | 23/04/2026 10:48 AM (5 أشهر منذ) |
|---|
| الاعتدال | 11/05/2026 03:33 PM (18 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 362607 [jishenghua jshERP حتى 3.6 updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode weixinUrl تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|