| タイトル | crmeb CRMEB-KY v5.6.1 Horizontal Overreach (IDOR) - Modify/delete user address |
|---|
| 説明 | When editAddress is called to update an address with a given $id, the code always believes that the address belongs to the currently authenticated user, regardless of its true owner. An attacker can simply set the id field in their request to the ID of any address in the system, and they will be able to modify or delete it. |
|---|
| ソース | ⚠️ https://github.com/August829/Yu/blob/main/58ead8e7e08bfb014.md |
|---|
| ユーザー | Yu Bao (UID 88956) |
|---|
| 送信 | 2025年08月30日 08:56 (1 年 ago) |
|---|
| モデレーション | 2025年09月13日 11:46 (14 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 323825 [CRMEB 迄 5.6.1 UserAddressServices.php editAddress 識別子 特権昇格] |
|---|
| ポイント | 19 |
|---|