漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Insecure direct object reference (IDOR) vulnerability in H6Web
Vulnerability Description
Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint to refer to another user. In addition, the first request could also allow the attacker to impersonate other users. As a result, all requests made after exploitation of the IDOR vulnerability will be executed with the privileges of the impersonated user.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
Anapi h6web 安全漏洞
Vulnerability Description
Anapi h6web是Anapi公司的一个管理软件。 Anapi h6web存在安全漏洞，该漏洞源于存在不安全的直接对象引用漏洞，会导致攻击者获取其他用户信息。
CVSS Information
N/A
Vulnerability Type
N/A