Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other users unique identifiers and enumerate information of all other end-users.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Shenzhen Fujia Technology OurPhoto 安全漏洞
Vulnerability Description
Shenzhen Fujia Technology OurPhoto是中国Shenzhen Fujia Technology公司的一个云相框软件。可以直接在手机上共享照片和视频文件。 Shenzhen Fujia Technology OurPhoto 1.4.1版本存在安全漏洞，该漏洞源于其/apiv1/*端点上的user_token授权头未正确实现。删除该值将导致所有请求成功允许攻击者绕过授权和会话管理导致攻击者通过POST api调用其他用户的唯一标识符并枚举所有其他终端用户的信息。
CVSS Information
N/A
Vulnerability Type
N/A