| शीर्षक | jishenghua https://github.com/jishenghua/jshERP <=3.5 IDOR |
|---|
| विवरण | A critical authorization flaw has been identified in this project, impacting dozens of routes. The intended system design defines each tenant as an independent group, where the tenant acts as the administrator with absolute management authority over other low-privilege users created within that group, while low-privilege users are restricted to usage permissions only. However, during SQL query execution, tenant identity validation is not properly enforced, resulting in low-privilege users being able to impersonate the tenant administrator and execute unauthorized operations. |
|---|
| स्रोत | ⚠️ https://github.com/jishenghua/jshERP/issues/127 |
|---|
| उपयोगकर्ता | ez-lbz (UID 87033) |
|---|
| सबमिशन | 25/07/2025 05:17 PM (1 वर्ष पहले) |
|---|
| संयम | 10/08/2025 01:31 PM (16 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 319374 [jshERP तक 3.5 Endpoint deleteBatch ids अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|