Description
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
fushengqian fuint
Default version status: unaffected
0 to ≤ 57ec01895e22dd93f16f493db30a77a7c1b148f2affected
pkg:github/fushengqian/fuintReferences
- https://hackmd.io/@hieuPenguinnn/fuint-booking-detail-idor ↗
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientBookController.java#L252-L265 ↗
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/common/service/impl/BookItemServiceImpl.java#L237-L258 ↗
- https://www.vulncheck.com/advisories/fuint-through-commit-57ec018-idor-via-bookid-in-mybookdetail ↗