Improper Privilege Management in liukuo362573/yishaadmin


Reported on

Jan 22nd 2022


Hi there yishaadmin maintainer team, I would like to report an improper privilege management in yishaadmin source code. The link /admin/ToolManage/Server/GetServerJson requires no authentication and accessible for everyone, which returns server info like RAM, CPU usage.

Proof of Concept

  1. Access the link without logging in to yishaadmin page
  2. See that the API returns data about server side information.


This vulnerability is capable of server side information disclosure.

We are processing your report and will contact the liukuo362573/yishaadmin team within 24 hours. a year ago
We have contacted a member of the liukuo362573/yishaadmin team and are waiting to hear back a year ago
liukuo362573 validated this vulnerability a year ago
M0rphling has been awarded the disclosure bounty
The fix bounty is now up for grabs
liukuo362573 marked this as fixed in 3.1 with commit 6ff260 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation