| शीर्षक | 大灰狼 WCMS null Authorization Bypass |
|---|
| विवरण | There is an authentication bypass issue in this project.Use MD5 to process the key (fixed key wcms), combine with RC4 algorithm to perform XOR encryption on the data, and output through Base64 encoding; after passing in the encrypted openid value, decrypt to match the uid, and check permissions in the database. So as long as there is a uid, one can freely log into someone else's account. |
|---|
| स्रोत | ⚠️ https://gitee.com/nwtmd5/cve/issues/IC6O7D |
|---|
| उपयोगकर्ता | TTTlw1024 (UID 83078) |
|---|
| सबमिशन | 09/05/2025 03:33 PM (1 वर्ष पहले) |
|---|
| संयम | 24/05/2025 07:32 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 310237 [WCMS तक 8.3.11 Login getallcon getMemberByUid uid कमजोर प्रमाणीकरण] |
|---|
| अंक | 19 |
|---|