Yunwang OA-Unauthorized modification of administrator password vulnerability

Vulnerability Product:ywoa
Vulnerability version:before 2024.07.04
Vulnerability type:unauthorized
Vulnerability Details：
1. Globally search for the http.authorizeRequests keyword, and in the Spring Security configuration file com/cloudweb/oa/config/WebSecurityConfig.java:187, you will find that any user can access the /setup/** directory files
<img width="916" alt="image" src="https://github.com/cloudwebsoft/ywoa/assets/160001438/3cdf8d06-7d6f-4b20-a60b-d1f4e9ebe231">

2. Analyzing the files in the /setup/** directory, we can find that this directory is used to set the database connection address. If unauthorized access is possible, the existing database can be reset to modify the administrator password.
<img width="909" alt="image" src="https://github.com/cloudwebsoft/ywoa/assets/160001438/dd3990ce-901c-4b0b-be33-fbd7abff81d4">

3. Construct POC access routing, reset the database connection address, and reset the backend administrator password

```
http://localhost:8096/oa/setup/setup.jsp
```

rabbit/OA协同办公系统，流程专家（带有低代码开发平台的OA）

Content Risk Flag

Comments (1)

rabbit/OA协同办公系统，流程专家（带有低代码开发平台的OA） .gitee-modal { width: 500px !important; }

Content Risk Flag