| Título | zhangbw409 library_manager_system 56514767a5207caf5e04c2cea379dfaa8cb5f00b Missing Authorization |
|---|
| Descripción | The affected components are the controllers under `src/main/java/com/zbw/controller/` (`AdminController.java`, `BookController.java`, `UserController.java`, `BorrowingController.java`). The application sets `session.admin` and `session.user` at login time but never verifies these attributes in any controller handler. There is no Spring Security dependency in `pom.xml`, no `HandlerInterceptor`, no `WebMvcConfigurer`, and no servlet `Filter` that enforces authentication or the administrator role. As a result, every administrative business endpoint is reachable by an unauthenticated remote attacker:
- `BookController.addBook()` (`/addBook`, lines 34-42)
- `BookController.addBookCategory()` (`/addBookCategory`, lines 91-99)
- `BookController.deleteBookCategoryById()` (`/deleteCategory`, lines 107-115)
- `UserController.addUser()` (`/addUser`, lines 230-239)
- `UserController.deleteUserByUserId()` (`/deleteUser`, lines 214-222)
- `UserController.updateUser()`, `returnBook()`, and `borrowingBook()` (lines 146-177)
- `AdminController.updateAdmin()` (lines 162-166, although this one additionally dereferences `session.admin` and fails with HTTP 500 when no session exists)
Live verification against the deployed application showed that anonymous requests can create users, create books, create and delete book categories, and delete users. For example, the anonymous request `POST /addUser` with `userName=pwnuser&userPwd=pwnpass&[email protected]` returned `true` and inserted the row, `POST /addBook` returned `true`, and `GET /deleteUser?userId=<id>` deleted the target account. The only "protection" on several HTML pages is an accidental NullPointerException when the Thymeleaf header calls `session.admin.getAdminName()`; the JSON business APIs do not touch the session at all and remain fully reachable. Any remote attacker can therefore tamper with or destroy library data, create arbitrary user accounts, and invoke administrator functionality; a normal authenticated user is likewise not restricted from the administrator APIs.
|
|---|
| Fuente | ⚠️ https://github.com/zhangbw409/library_manager_system/issues/15 |
|---|
| Usuario | ME4Dream (UID 85787) |
|---|
| Sumisión | 2026-10-17 13:32 (hace 22 días) |
|---|
| Moderación | 2026-11-08 21:36 (22 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 433014 [zhangbw409 library_manager_system UserController.java BookController.addBook userName/userPwd/userEmail/userId escalada de privilegios] |
|---|
| Puntos | 20 |
|---|