| 제목 | fuyang_lipengjun platform v1.0 broken function level authorization |
|---|
| 설명 | PoC (Proof of Concept):
Log in to the application with any user account, including those with low privileges.
Send a GET request to the endpoint http://host/attributecategory/queryAll.
The server returns a complete list of attribute category information. This data should typically be restricted to users with administrative privileges.
Effect: The queryAll method in the AttributeCategoryController class lacks any permission checks. This allows any authenticated user, regardless of their assigned roles or permissions, to access the list of all attribute category data, leading to unauthorized information disclosure. |
|---|
| 원천 | ⚠️ https://www.cnblogs.com/aibot/p/19063429 |
|---|
| 사용자 | lucasg2g (UID 84737) |
|---|
| 제출 | 2025. 09. 12. AM 10:47 (8 개월 ago) |
|---|
| 모더레이션 | 2025. 09. 18. AM 07:52 (6 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 324795 [fuyang_lipengjun platform 1.0 queryAll AttributeCategoryController 권한 상승] |
|---|
| 포인트들 | 20 |
|---|