Design/Logic Flaw

2021-10-1512:15:00

PRIOn knowledge base

www.prio-n.com

8.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.1%

JSON

The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.

CPENameOperatorVersion
xinhe_teaching_platform_systemeq2021.0.118

CPE	Name	Operator	Version
	xinhe_teaching_platform_system	eq	2021.0.118

References

www.twcert.org.tw/tw/cp-132-5200-3d3ca-1.html