| शीर्षक | CodeGenieApp serverless-express <=4.17.1 Property Injection |
|---|
| विवरण | The application's /users endpoint accepts arbitrary JSON in the filter query parameter and uses it to dynamically access object properties without validation. This allows authenticated attackers to enumerate database schema, inspect prototype chains, and perform reconnaissance against the application's data structures. While currently limited to information disclosure, this vulnerability provides attackers with valuable schema knowledge that can facilitate targeted attacks. |
|---|
| स्रोत | ⚠️ https://github.com/AnalogyC0de/public_exp/issues/19 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 01/03/2026 12:27 AM (7 महीनों पहले) |
|---|
| संयम | 11/03/2026 05:51 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 350474 [CodeGenieApp serverless-express तक 4.17.1 Users Endpoint utils/dynamodb.ts filter अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|