| Название | elunez eladmin latest broken function level authorisation |
|---|
| Описание | Unauthorized Log Viewing:
Any authenticated user can view the details of any error log, even those generated by other users.
The queryErrorLogDetail method in SysLogController does not perform any ownership check on the log ID.
Request:
GET /api/logs/error/1 HTTP/1.1 |
|---|
| Источник | ⚠️ https://www.cnblogs.com/aibot/p/19063331 |
|---|
| Пользователь | Anonymous User |
|---|
| Представление | 30.08.2025 16:23 (1 Год назад) |
|---|
| Модерация | 07.09.2025 20:35 (8 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 323040 [elunez eladmin до 2.7 SysLogController /api/logs/error/1 queryErrorLogDetail эскалация привилегий] |
|---|
| Баллы | 17 |
|---|