| タイトル | diaowen DWSurvey v6.14.0 Improper Access Controls |
|---|
| 説明 | The system's endpoint for modifying survey status lacks proper authorization checks on the current user. Any authenticated regular user, merely by knowing another user's survey ID, can illegally change that survey's publication or closing status (e.g., altering a survey from "design" mode to "published" or "closed"). After successfully exploiting this vulnerability, an attacker can verify the status tampering through the survey details query endpoint. |
|---|
| ソース | ⚠️ https://drive.google.com/file/d/1Ziv1My5IHNnEobdHOwCfx7d6eHUs-gnS/view?usp=sharing |
|---|
| ユーザー | Stephen Lin (UID 98370) |
|---|
| 送信 | 2026年06月11日 18:27 (2 月 ago) |
|---|
| モデレーション | 2026年08月03日 19:50 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 385634 [diaowen DWSurvey 迄 6.14.0 Survey Status up-survey-status.do 特権昇格] |
|---|
| ポイント | 20 |
|---|