| 제목 | jishenghua jshERP 3.6 Improper Authorization |
|---|
| 설명 | Authenticated insecure direct object reference in GET /jshERP-boot/user/info.
A logged-in same-tenant user (for example sales role test123) can pass another user's id and receive the stored password digest. Login compares that digest with equality, so the leaked value can be replayed on POST /jshERP-boot/user/login to take over the target account (demo tenant owner jsh). Admin rights are not required. User IDs are listed by /user/getUserList.
This is not CVE-2025-60800. CVE-2025-60800 is unauthenticated path traversal to the same endpoint. Current LogCostFilter blocks .. and %2e/%2E. The remaining issue is missing object-level authorization after login.
Tested: GitHub master ad6cf886dd4e0676723060a25d361c703dc56bc0 (3.6-SNAPSHOT), same code path in tag v3.6.
Full advisory and PoC:
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/VULDB_REPORT.md
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/poc.sh
CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) |
|---|
| 원천 | ⚠️ https://github.com/Bob-wentao/jsherp-user-info-idor/ |
|---|
| 사용자 | bobtao666 (UID 100998) |
|---|
| 제출 | 2026. 09. 04. PM 05:16 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. AM 11:02 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 408204 [jishenghua jshERP 까지 3.6 User Info Endpoint /user/info user_id 약한 암호화] |
|---|
| 포인트들 | 0 |
|---|