| タイトル | jishenghua jshERP 3.6 Improper Authorization |
|---|
| 説明 | Authenticated insecure direct object reference in GET /jshERP-boot/user/info.
A logged-in same-tenant user (for example sales role test123) can pass another user's id and receive the stored password digest. Login compares that digest with equality, so the leaked value can be replayed on POST /jshERP-boot/user/login to take over the target account (demo tenant owner jsh). Admin rights are not required. User IDs are listed by /user/getUserList.
This is not CVE-2025-60800. CVE-2025-60800 is unauthenticated path traversal to the same endpoint. Current LogCostFilter blocks .. and %2e/%2E. The remaining issue is missing object-level authorization after login.
Tested: GitHub master ad6cf886dd4e0676723060a25d361c703dc56bc0 (3.6-SNAPSHOT), same code path in tag v3.6.
Full advisory and PoC:
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/VULDB_REPORT.md
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/poc.sh
CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) |
|---|
| ソース | ⚠️ https://github.com/Bob-wentao/jsherp-user-info-idor/ |
|---|
| ユーザー | bobtao666 (UID 100998) |
|---|
| 送信 | 2026年09月04日 17:16 (2 月 ago) |
|---|
| モデレーション | 2026年10月11日 11:02 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 408204 [jishenghua jshERP 迄 3.6 User Info Endpoint /user/info user_id 弱い暗号化] |
|---|
| ポイント | 0 |
|---|