| शीर्षक | SKyTech HuiRan(XinKa) Host Reseller System <=2.0.0 Authentication Bypass |
|---|
| विवरण | The vulnerability in the HuiRan(XinKa) Host Reseller System allows an attacker to reset the password of any user account without authorization. By manipulating the 'voucher' session variable through a series of crafted POST requests to the application's 'sendyzms', 'sendyzm', and 'findpass' endpoints, the attacker can bypass the normal password reset code verification process and change a user's password to one of their choosing, effectively taking over the account. The exploit hinges on the system's failure to properly validate and segregate user session data during the password reset process. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/WwPWWizD2Spk |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 01/01/2024 12:15 PM (3 साल पहले) |
|---|
| संयम | 01/01/2024 04:41 PM (4 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 249444 [HuiRan Host Reseller System तक 2.0.0 HTTP POST Request findpass?do=4 अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|