| Titel | crmeb CRMEB-KY v5.6.1 Low permission users can reset administrator password |
|---|
| Beschreibung | As you can see from the code, the save method receives a $id and a $data array containing the new data. It first gets administrator information from the database based on $id, and then, if the pwd field is included in $data, it updates the administrator's password. This code itself does not check whether the current operator has permission to modify the target user ($id) |
|---|
| Quelle | ⚠️ https://github.com/August829/Yu/blob/main/58ead8e7e08bfb013.md |
|---|
| Benutzer | Yu Bao (UID 88956) |
|---|
| Einreichung | 30.08.2025 06:12 (vor 1 Jahr) |
|---|
| Moderieren | 13.09.2025 11:46 (14 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 323824 [CRMEB bis 5.6.1 Administrator Password SystemAdminServices.php save id erweiterte Rechte] |
|---|
| Punkte | 19 |
|---|