Improper Authentication in liukuo362573/yishaadmin

Valid

Reported on

Jan 22nd 2022

Description

Hi there yishaadmin maintainer, I would like to report an improper authentication vulnerability in yishaadmin source code. The link /admin/OrganizationManage/User/GetFormJson?id={user-id} does not require any authentication and return sensitive user data for anyone like username, gender, birthday,...

Proof of Concept

Access the link http://106.14.124.170/admin/OrganizationManage/User/GetFormJson?id=16508640061130153 in an incognito without logging in.
See that the page returns with user data.

Impact

This vulnerability is capable of improper authentication.

We are processing your report and will contact the liukuo362573/yishaadmin team within 24 hours. 2 years ago

A GitHub Issue asking the maintainers to create a SECURITY.md exists 2 years ago

We have contacted a member of the liukuo362573/yishaadmin team and are waiting to hear back 2 years ago

liukuo362573 validated this vulnerability 2 years ago

ComradeKtg has been awarded the disclosure bounty

The fix bounty is now up for grabs

liukuo362573 marked this as fixed in 3.1 with commit 6ff260 2 years ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

to join this conversation