Improper Access Control in liukuo362573/yishaadmin
Jan 24th 2022
YiShaAdmin is vulnerable to Improper Access Control via the
/admin/SystemManage/LogApi/GetPageListJson endpoint. Anyone can view the Log API of the YiShaAdmin without any authentication. This API contains the sensitive information include:
ExecuteURL, ExecuteParam, ExecuteTime, ExecuteStatus, Request Time,...
Proof of Concept
Access this link below in an incognito browser:
You can view the sensitive information without login.
You can also modify the
pageSize parameter to other values such as
100, 1000 to view more records.
This vulnerability is capable of Improper Access Control and sensitive data exposure.
We are processing your report and will contact the liukuo362573/yishaadmin team within 24 hours. a year ago
We have contacted a member of the liukuo362573/yishaadmin team and are waiting to hear back a year ago
liukuo362573 validated this vulnerability a year ago
KhanhCM has been awarded the disclosure bounty
The fix bounty is now up for grabs
liukuo362573 marked this as fixed in 3.1 with commit c5910a a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation