| शीर्षक | orionsec Orion-ops (server component) <= master commit 5925824997a3109651bbde07460958a7be249ed1 Improper Authorization / Horizontal Privilege Escalation |
|---|
| विवरण | Orion-ops intends /user/update to let users edit their own profile. However, the implementation never enforces that invariant. The controller trusts the supplied id and the service layer does not compare it to Currents.getUserId(). Therefore, any session can update any row in user_info, with only the roleType field being guarded. This contradicts the intended design and gives low-privilege users leverage to lock out administrators or tamper with audit-relevant information. |
|---|
| स्रोत | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-privilege-escalation-1/report.md |
|---|
| उपयोगकर्ता | sh7err03 (UID 92418) |
|---|
| सबमिशन | 10/11/2025 12:19 PM (9 महीनों पहले) |
|---|
| संयम | 30/11/2025 03:25 PM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 333818 [orionsec orion-ops तक 5925824997a3109651bbde07460958a7be249ed1 User Profile UserController.java update पहचान अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|