Lucene search
Lujiefsi28B70DEE-06E9-4316-ADA4-B7CB4FFFC913HistoryApr 02, 2023 - 5:36 a.m.
IDOR make users can withdraw other's application
2023-04-0205:36:31
lujiefsi
www.huntr.dev
9
idor; application withdrawal; burpsuite; post request; bugbounty
EPSS
0.002
Percentile
61.1%
Proof of Concept
1 user1 submit a application with id = 8, user2 submit a application with id = 9
2 user1 withdraw the application , using burpsuite get the post, which can be like :POST /inlong/manager/api/workflow/cancel/8 HTTP/1.1
3 change 8 as 9 and we can find that user2’s application is cancled.
Related
cvelist
cvelist
osv
osv
Apache InLong has Files or Directories Accessible to External Parties
2023-07-06 21:14:59
CVE-2023-31064
2023-05-22 16:15:09
prion
prion
Xxe
2023-05-22 16:15:00
veracode
veracode
Insecure Direct Object References (IDOR)
2023-05-26 04:43:48
github
github
Apache InLong has Files or Directories Accessible to External Parties
2023-07-06 21:14:59
nvd
nvd
CVE-2023-31064
2023-05-22 16:15:09
cve
cve
CVE-2023-31064
2023-05-22 16:15:09
cnvd
cnvd
Apache InLong Security Bypass Vulnerability (CNVD-2023-42962)
2023-05-28 00:00:00