Modify the id parameter to the id of another user, Because there is no verification here that the user id is consistent with the current user.
If the password of other users with the same permission is the same as the password field, you can horizontally exceed the authority to change the password of other users. If the password of the high-permission user is the same as the password field, you can change the password of the high-permission account vertically.
Modify id to 1. The user whose ID is 1 is the highest privileged root user, prompts you that the modification is successful, and then requires you to log in again.
Follow the `com.zyd.blog.business.service.impl#updatePwd` ：
First, obtain the User object according to the user id passed by the front-end user. If the User is not null, determine whether the password field passed by the user is consistent with the user password corresponding to the id, and if so, reset the password.
So in fact, neither verifying whether the user id is the currently logged in user, nor verifying that the original password is the password of the current user, which eventually leads to ultra vires vulnerability.
Modify the id parameter to the id of another user, Because there is no verification here that the user id is consistent with the current user.
If the password of other users with the same permission is the same as the password field, you can horizontally exceed the authority to change the password of other users. If the password of the high-permission user is the same as the password field, you can change the password of the high-permission account vertically.
Modify id to 1. The user whose ID is 1 is the highest privileged root user, prompts you that the modification is successful, and then requires you to log in again.
Follow the `com.zyd.blog.business.service.impl#updatePwd` ：
First, obtain the User object according to the user id passed by the front-end user. If the User is not null, determine whether the password field passed by the user is consistent with the user password corresponding to the id, and if so, reset the password.
So in fact, neither verifying whether the user id is the currently logged in user, nor verifying that the original password is the password of the current user, which eventually leads to ultra vires vulnerability.
Modify the id parameter to the id of another user, Because there is no verification here that the user id is consistent with the current user.
If thepassword of other userswith the samepermission is the sameasthe passwordfield, you can horizontally exceed the authority to change the password of other users. If the password of the high-permission user is the same as the password field, you can change the password of the high-permission account vertically.
Modifyid to 1.The user whoseID is 1 is the highest privileged root user, promptsyou that the modification is successful, and then requiresyouto log in again.
Follow the `com.zyd.blog.business.service.impl#updatePwd` ：
First,obtain the User object according to the user id passed by the front-end user. If the User is not null, determine whether the password field passed by the user is consistent with the user password corresponding to the id, and if so, reset the password.
So in fact, neither verifying whether the user id is the currently logged in user, nor verifying that the original password is the password of the current user, which eventually leads to ultra vires vulnerability.
OneBlog v2.3.4 is vulnerable to insecure privileges. Low-level administrators can reset the passwords of high-level administrators who exceed their permissions.
### vulnerability recurrence
First log in to the background using the low-privileged user admin/123456
Modifythe id parameter to theid of anotheruser, Because there isnoverificationhere that the user id is consistent with the current user.
If thepasswordof other userswith the same permission is the same as the passwordfield, you can horizontally exceed the authority to changethepassword of other users. If the password of the high-permission user is the same as the password field, you can change the password of the high-permission account vertically.
Modify id to 1. The user whose ID is 1 is the highest privileged root user, prompts youthat the modification is successful, and then requires you to log in again.
First, obtain the User object according to the user id passed by the front-end user. If the User is not null, determine whether the password field passed by the user is consistent with the user password corresponding to the id, and if so, reset the password.
So in fact, neither verifying whether the user id is the currently logged in user, nor verifying that the original password is the password of the current user, which eventually leads to ultra vires vulnerability.
OneBlog v2.3.4 is vulnerable to insecure privileges. Low-level administrators can reset the passwords of high-level administrators who exceed their permissions.
### vulnerability recurrence
First log in to the background using the low-privileged user admin/123456
Modify the id parameter to the id of another user, Because there is no verification here that the user id is consistent with the current user.
If the password of other users with the same permission is the same asthe password field, you can horizontally exceed the authority to changethe password of other users. If the password of the high-permission user is the same as the passwordfield, you can change thepassword ofthe high-permissionaccount vertically.
Modify id to 1. The user whose ID is 1is the highest privileged root user, prompts you that the modificationis successful, and then requiresyou to log in again.
Follow the `com.zyd.blog.business.service.impl#updatePwd` ：
First,obtain the User object according to the user id passed by the front-end user. If the User is not null, determine whether the password field passed by the user is consistent with the user password corresponding to the id, and if so, reset the password.
So in fact, neither verifying whether the user id is the currently logged in user, nor verifying that the original password is the password of the current user, which eventually leads to ultra vires vulnerability.
OneBlog v2.3.4 is vulnerable to insecure privileges. Low-level administrators can reset the passwords of high-level administrators who exceed their permissions.
### vulnerability recurrence
First log in to the background using the low-privileged user admin/123456，This is a low-privileged user
Modify the id parameter to the id of another user, Because there is no verification here that the user id is consistent with the current user.
If the passwords of other users with the same permissions are the sameas the password fields passed in, you can change the passwords of userswith the same permissions horizontally. If the password of the highly privileged user is the same asthe password field passedin, you canchange the passwordof the high privileged account vertically. This feature does not verify that the password field is consistent with the password of the currently logged-in user, so password can be entered at will
Change id to 1. The user with an ID of1 is the root user with the highest authority, because the password ofthe root user is the same as the`123456` passed in by password, so it is prompted that the modification was successful, and then you are required to log in again.
First, obtain the User object according to the user id passed by the front-end user. If the User is not null, determine whether the password field passed by the user is consistent with the user password corresponding to the id, and if so, reset the password.
So in fact, neither verifying whether the user id is the currently logged in user, nor verifying that the original password is the password of the current user, which eventually leads to ultra vires vulnerability.
