| शीर्षक | crmeb CRMEB-KY v5.6.1 Horizontal Overreach (IDOR) - Modify/delete user address |
|---|
| विवरण | When editAddress is called to update an address with a given $id, the code always believes that the address belongs to the currently authenticated user, regardless of its true owner. An attacker can simply set the id field in their request to the ID of any address in the system, and they will be able to modify or delete it. |
|---|
| स्रोत | ⚠️ https://github.com/August829/Yu/blob/main/58ead8e7e08bfb014.md |
|---|
| उपयोगकर्ता | Yu Bao (UID 88956) |
|---|
| सबमिशन | 30/08/2025 08:56 AM (1 वर्ष पहले) |
|---|
| संयम | 13/09/2025 11:46 AM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 323825 [CRMEB तक 5.6.1 UserAddressServices.php editAddress id अधिकार वृद्धि] |
|---|
| अंक | 19 |
|---|