| Title | jishenghua jshERP 3.6 Improper Authorization |
|---|
| Description | Authenticated insecure direct object reference in GET /jshERP-boot/user/info.
A logged-in same-tenant user (for example sales role test123) can pass another user's id and receive the stored password digest. Login compares that digest with equality, so the leaked value can be replayed on POST /jshERP-boot/user/login to take over the target account (demo tenant owner jsh). Admin rights are not required. User IDs are listed by /user/getUserList.
This is not CVE-2025-60800. CVE-2025-60800 is unauthenticated path traversal to the same endpoint. Current LogCostFilter blocks .. and %2e/%2E. The remaining issue is missing object-level authorization after login.
Tested: GitHub master ad6cf886dd4e0676723060a25d361c703dc56bc0 (3.6-SNAPSHOT), same code path in tag v3.6.
Full advisory and PoC:
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/VULDB_REPORT.md
https://github.com/Bob-wentao/jsherp-user-info-idor/blob/main/poc.sh
CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) |
|---|
| Source | ⚠️ https://github.com/Bob-wentao/jsherp-user-info-idor/ |
|---|
| User | bobtao666 (UID 100998) |
|---|
| Submission | 09/04/2026 17:16 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:02 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 408204 [jishenghua jshERP up to 3.6 User Info Endpoint /user/info user_id weak password hash] |
|---|
| Points | 0 |
|---|