| Titre | 延禾信息 fuint门店会员营销系统 V1.0 Authorization Bypass |
|---|
| Description | The application contains a critical flaw in the user authentication logic where the securely generated authentication token is immediately overwritten with the user's mobile phone number. This results in an authentication bypass vulnerability that allows any attacker who knows a user's phone number to gain unauthorized access to that user's account. |
|---|
| La source | ⚠️ https://github.com/fushengqian/fuint/issues/67 |
|---|
| Utilisateur | 1098024193 (UID 45260) |
|---|
| Soumission | 21/10/2025 05:07 (il y a 12 mois) |
|---|
| Modérer | 02/11/2025 18:47 (13 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 330915 [fushengqian fuint Authentication Token ClientSignController.java élévation de privilèges] |
|---|
| Points | 18 |
|---|