| عنوان | jishenghua jshERP 3.6 Improper Authorization |
|---|
| الوصف | Authenticated insecure direct object reference in GET /jshERP-boot/user/info.
A logged-in same-tenant user (for example sales role test123) can pass another user's id and receive the stored password digest. Login compares that digest with equality, so the leaked value can be replayed on POST /jshERP-boot/user/login to take over the target account (demo tenant owner jsh). Admin rights are not required. User IDs are listed by /user/getUserList.
This is not CVE-2025-60800. CVE-2025-60800 is unauthenticated path traversal to the same endpoint. Current LogCostFilter blocks .. and %2e/%2E. The remaining issue is missing object-level authorization after login.
Tested: GitHub master ad6cf886dd4e0676723060a25d361c703dc56bc0 (3.6-SNAPSHOT), same code path in tag v3.6.
Full advisory and PoC:
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/VULDB_REPORT.md
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/poc.sh
CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) |
|---|
| المصدر | ⚠️ https://github.com/Bob-wentao/jsherp-user-info-idor/ |
|---|
| المستخدم | bobtao666 (UID 100998) |
|---|
| ارسال | 04/09/2026 05:16 PM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 11:02 AM (1 month later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 408204 [jishenghua jshERP حتى 3.6 User Info Endpoint /user/info user_id تشفير ضعيف] |
|---|
| النقاط | 0 |
|---|