| عنوان | SeaCMS 13.6 Information Disclosure |
|---|
| الوصف | SeaCMS 13.6 `ass.php` returns playback metadata and the complete video URL array without enforcing the paywall or VIP authorization result. An unauthenticated attacker can directly request the endpoint and retrieve protected playback URLs even when the response indicates `isauth` as `n`, resulting in an authorization bypass. |
|---|
| المصدر | ⚠️ https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md |
|---|
| المستخدم | T-Chachamaru (UID 99844) |
|---|
| ارسال | 16/07/2026 09:27 AM (2 أشهر منذ) |
|---|
| الاعتدال | 30/08/2026 08:42 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397104 [SeaCMS حتى 13.6 /ass.php تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|