Improper Access Control in liukuo362573/yishaadmin
Valid
Reported on
Jan 24th 2022
Description
YiShaAdmin is vulnerable to Improper Access Control via the /admin/SystemManage/LogApi/GetPageListJson endpoint. Anyone can view the Log API of the YiShaAdmin without any authentication. This API contains the sensitive information include: ExecuteURL, ExecuteParam, ExecuteTime, ExecuteStatus, Request Time,...
Proof of Concept
Access this link below in an incognito browser:
http://106.14.124.170/admin/SystemManage/LogApi/GetPageListJson?pageSize=10&pageIndex=1&sort=Id&sortType=desc&UserName=&ExecuteUrl=&LogStatus=&StartTime=&EndTime=
You can view the sensitive information without login.
You can also modify the pageSize parameter to other values such as 100, 1000 to view more records.
Impact
This vulnerability is capable of Improper Access Control and sensitive data exposure.
We are processing your report and will contact the
liukuo362573/yishaadmin
team within 24 hours.
a year ago
KhanhCM modified the report
a year ago
We have contacted a member of the
liukuo362573/yishaadmin
team and are waiting to hear back
a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
LogApiDetail.cshtml#L5-L61
has been validated
LogApiIndex.cshtml#L4-L144
has been validated
to join this conversation