Description
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sunkaifei FlyCms
Default version status: unaffected
0 to ≤ edfdf724c3b944310f60c29aa755d03a00a75837affected
pkg:github/sunkaifei/FlyCmsReferences
- https://github.com/sunkaifei/FlyCms/issues/19 ↗
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/model/service/ActionService.java ↗
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/ActionController.java ↗
- https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-missing-authorization-via-action-counter-endpoint ↗