| タイトル | jishenghua jshERP ad6cf886dd4e0676723060a25d361c703dc56bc0 Missing Authorization |
|---|
| 説明 | jishenghua jshERP contains a missing authorization vulnerability in the financial receipt update functionality. The PUT /accountHead/updateAccountHeadAndDetail endpoint allows an authenticated user with financial editing privileges to modify a receipt or payment that has already been audited without verifying whether the document is still authorized for modification. The service does not load and validate the persisted audit status before applying the submitted changes and does not require the document to be reverse-audited first. As a result, a finalized financial document can be modified while remaining in the audited state. Updating the receipt amount also recomputes the remaining debt of linked business documents, allowing previously finalized settlement data to be altered without returning the document to an unaudited state. In the verified proof of concept, an audited receipt was changed from 30 to 90 while its audit status remained unchanged, and the linked bill's remaining debt changed from 70 to 10. The issue was reproduced at commit ad6cf886dd4e0676723060a25d361c703dc56bc0.
The issue has been reported to the upstream maintainers via GitHub Issue; no maintainer response has been received to date. |
|---|
| ソース | ⚠️ https://github.com/jishenghua/jshERP/issues/167 |
|---|
| ユーザー | cztang (UID 101252) |
|---|
| 送信 | 2026年09月18日 04:22 (18 日 ago) |
|---|
| モデレーション | 2026年10月05日 18:27 (18 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413644 [jishenghua jshERP 迄 3.5 Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail 特権昇格] |
|---|
| ポイント | 20 |
|---|