Description
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
zoujingli think-plugs-admin
Default version status: unaffected
0 to ≤ 1.0.81affected
pkg:github/zoujingli/think-plugs-adminReferences
- https://hackmd.io/@hieuPenguinnn/thinkadmin-file-edit-missing-owner-scope-idor ↗
- https://github.com/zoujingli/think-plugs-admin/blob/v1.0.81/src/controller/File.php#L52-L82 ↗
- https://github.com/zoujingli/ThinkLibrary/blob/v6.1.101/src/helper/FormHelper.php#L51-L86 ↗
- https://github.com/zoujingli/ThinkLibrary/blob/v6.1.101/src/service/SystemService.php#L206-L222 ↗
- https://www.vulncheck.com/advisories/thinkadmin-think-plugs-admin-through-1.0.81-idor-via-admin-file-edit ↗