| 标题 | elunez eladmin latest broken function level authorisation |
|---|
| 描述 | Unauthorized Log Viewing:
Any authenticated user can view the details of any error log, even those generated by other users.
The queryErrorLogDetail method in SysLogController does not perform any ownership check on the log ID.
Request:
GET /api/logs/error/1 HTTP/1.1 |
|---|
| 来源 | ⚠️ https://www.cnblogs.com/aibot/p/19063331 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2025-08-30 16時23分 (1 年前) |
|---|
| 管理 | 2025-09-07 20時35分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 323040 [elunez eladmin 直到 2.7 SysLogController /api/logs/error/1 queryErrorLogDetail 权限提升] |
|---|
| 积分 | 17 |
|---|