| عنوان | JeecgBoot 3.9.1 Improper Access Controls |
|---|
| الوصف | The POST /sys/comment/add, POST /sys/comment/edit, and POST /sys/checkRule/add endpoints lack any @RequiresPermissions annotations and bind full entity objects from request bodies without overriding identity fields server-side. Any authenticated user—including those with only the default test role—can inject arbitrary fromUserId and toUserId values when posting or editing comments, making those comments appear to originate from any target user including the administrator; the same user can inject createBy when creating check rules, forging audit records to attribute actions to arbitrary identities. |
|---|
| المصدر | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9598 |
|---|
| المستخدم | AliceS614 (UID 94277) |
|---|
| ارسال | 02/05/2026 11:52 AM (5 أشهر منذ) |
|---|
| الاعتدال | 26/05/2026 02:50 PM (24 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 365637 [JeecgBoot حتى 3.9.1 /sys/comment/add تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|