| 제목 | 1024-lab smart-admin v3.30.0 Improper Access Controls |
|---|
| 설명 | The /support/config/queryByKey endpoint of the system only validates the login state and performs no authorization check (Improper Access Control). Any authenticated
low-privileged user can pass configKey=super_password to read the system's master/super password in plaintext. In the login logic this password is compared in plaintext, and once
matched, password hash verification and 2FA are skipped. An attacker can thereby take over any account, including the super administrator. |
|---|
| 사용자 | s1mple_xy (UID 82894) |
|---|
| 제출 | 2026. 09. 23. PM 12:31 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 07:43 (18 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416747 [1024-lab smart-admin 까지 3.30.0 Support Config Query queryByKey configKey 권한 상승] |
|---|
| 포인트들 | 20 |
|---|