| عنوان | diaowen DWSurvey v6.14.0 Improper Access Controls |
|---|
| الوصف | The system's endpoint for modifying survey status lacks proper authorization checks on the current user. Any authenticated regular user, merely by knowing another user's survey ID, can illegally change that survey's publication or closing status (e.g., altering a survey from "design" mode to "published" or "closed"). After successfully exploiting this vulnerability, an attacker can verify the status tampering through the survey details query endpoint. |
|---|
| المصدر | ⚠️ https://drive.google.com/file/d/1Ziv1My5IHNnEobdHOwCfx7d6eHUs-gnS/view?usp=sharing |
|---|
| المستخدم | Stephen Lin (UID 98370) |
|---|
| ارسال | 11/06/2026 06:27 PM (2 أشهر منذ) |
|---|
| الاعتدال | 03/08/2026 07:50 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 385634 [diaowen DWSurvey حتى 6.14.0 Survey Status up-survey-status.do تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|