| タイトル | jishenghua https://github.com/jishenghua/jshERP <=3.5 IDOR(arbitrary admin count add) |
|---|
| 説明 | A high-risk IDOR vulnerability has been discovered in the latest version (v3.5). After logging in with a low-privilege role account, users can send requests to the /jshERP-boot/user/addUser endpoint to create new accounts, including high-privilege accounts and accounts with custom permissions assigned to other groups. This functionality should only be accessible to system administrators, but due to insufficient access control, it is exposed to unauthorized users. |
|---|
| ソース | ⚠️ https://github.com/jishenghua/jshERP/issues/125 |
|---|
| ユーザー | ez-lbz (UID 87033) |
|---|
| 送信 | 2025年07月25日 16:32 (1 年 ago) |
|---|
| モデレーション | 2025年08月10日 13:31 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 319373 [jshERP 迄 3.5 Endpoint addUser 特権昇格] |
|---|
| ポイント | 20 |
|---|