| Название | SeaCMS 13.6 Information Disclosure |
|---|
| Описание | SeaCMS 13.6 `ass.php` returns playback metadata and the complete video URL array without enforcing the paywall or VIP authorization result. An unauthenticated attacker can directly request the endpoint and retrieve protected playback URLs even when the response indicates `isauth` as `n`, resulting in an authorization bypass. |
|---|
| Источник | ⚠️ https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md |
|---|
| Пользователь | T-Chachamaru (UID 99844) |
|---|
| Представление | 16.07.2026 09:27 (2 месяцы назад) |
|---|
| Модерация | 30.08.2026 08:42 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397104 [SeaCMS до 13.6 /ass.php эскалация привилегий] |
|---|
| Баллы | 19 |
|---|