Description
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sunkaifei FlyCms
Default version status: unaffected
0 to ≤ edfdf724c3b944310f60c29aa755d03a00a75837affected
pkg:github/sunkaifei/FlyCmsReferences
- https://github.com/sunkaifei/FlyCms/issues/19 ↗
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/UserController.java ↗
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/user/service/UserService.java ↗
- https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/resources/mapper/user__UserDao.xml ↗
- https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-mass-assignment-via-ucenter-account-update ↗