| शीर्षक | elunez eladmin latest broken function level authorisation |
|---|
| विवरण | Unauthorized Log Viewing:
Any authenticated user can view the details of any error log, even those generated by other users.
The queryErrorLogDetail method in SysLogController does not perform any ownership check on the log ID.
Request:
GET /api/logs/error/1 HTTP/1.1 |
|---|
| स्रोत | ⚠️ https://www.cnblogs.com/aibot/p/19063331 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 30/08/2025 04:23 PM (1 वर्ष पहले) |
|---|
| संयम | 07/09/2025 08:35 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 323040 [elunez eladmin तक 2.7 SysLogController /api/logs/error/1 queryErrorLogDetail अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|