Lucene search

K
huntrIsdkrisna2F1E417D-CF64-4CFB-954B-3A9CB2F38191
HistoryFeb 13, 2023 - 4:47 a.m.

Broken access control - Someone still can comment in unactive FAQ NEWS

2023-02-1304:47:33
isdkrisna
www.huntr.dev
6
broken access control
inactive access
comment feature

0.001 Low

EPSS

Percentile

36.2%

Description

when a NEWS FAQ turns on the comments feature and disables post like this settings.

Screenshot >> https://imgur.com/a/9UY4QRf

if you create a FAQ news with those settings and view the post, you will notice that the comment section is disabled

Screenshot >> https://imgur.com/a/rY6zJt9

Proof of Concept

1.Open 2 Tab on your Browser
2.Tab A Visit some FAQ NEWS Then Fill All comment form
3.Tab B Open https://roy.demo.phpmyfaq.de/admin/?action=edit-news&id=1 (Link edit of A FAQ NEWS)
4.Tab B uncheck Activate and click edit news
5.Tab A send commend

0.001 Low

EPSS

Percentile

36.2%

Related for 2F1E417D-CF64-4CFB-954B-3A9CB2F38191