| 标题 | SeaCMS 13.6 Information Disclosure |
|---|
| 描述 | SeaCMS 13.6 `ass.php` returns playback metadata and the complete video URL array without enforcing the paywall or VIP authorization result. An unauthenticated attacker can directly request the endpoint and retrieve protected playback URLs even when the response indicates `isauth` as `n`, resulting in an authorization bypass. |
|---|
| 来源 | ⚠️ https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md |
|---|
| 用户 | T-Chachamaru (UID 99844) |
|---|
| 提交 | 2026-07-16 09時27分 (2 月前) |
|---|
| 管理 | 2026-08-30 08時42分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397104 [SeaCMS 直到 13.6 /ass.php 权限提升] |
|---|
| 积分 | 19 |
|---|