Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

unauthorized access #1

Open
LvZCh opened this issue Oct 29, 2024 · 0 comments
Open

unauthorized access #1

LvZCh opened this issue Oct 29, 2024 · 0 comments

Comments

@LvZCh
Copy link
Owner

LvZCh commented Oct 29, 2024 •
edited
Loading

Source code name：Tongda OA
Source code version：v11.2-v11.6

Vulnerability description：
general/hr/setting/attendance/leave/data.php No login verification was performed
image
Called by general/hr/setting/attention/newLeave/add.html
image

Open directly without logging in: http://192.168.0.106/general/hr/setting/attendance/newLeave/add.html
Unauthorized modification of annual leave rest time is allowed
image
image
It is also possible to view the names of all system users without authorization
image
image
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@LvZCh