| 제목 | jishenghua https://github.com/jishenghua/jshERP <=3.5 IDOR(arbitrary account deletion) |
|---|
| 설명 | A high-risk IDOR vulnerability has been discovered in the latest version (v3.5). After logging in with a low-privilege role account, users can send requests to the /jshERP-boot/user/deleteBatch endpoint to perform unauthorized batch operations, which should only be accessible by system administrator accounts. This allows attackers to target and affect multiple user accounts simultaneously. |
|---|
| 원천 | ⚠️ https://github.com/jishenghua/jshERP/issues/126 |
|---|
| 사용자 | ez-lbz (UID 87033) |
|---|
| 제출 | 2025. 07. 25. PM 04:37 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 08. 10. PM 01:31 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 319374 [jshERP 까지 3.5 Endpoint deleteBatch ids 권한 상승] |
|---|
| 포인트들 | 19 |
|---|