Design/Logic Flaw

2021-10-1512:15:00

PRIOn knowledge base

www.prio-n.com

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.

CPENameOperatorVersion
xinhe_teaching_platform_systemeq2021.0.118

CPE	Name	Operator	Version
	xinhe_teaching_platform_system	eq	2021.0.118

References

www.twcert.org.tw/tw/cp-132-5201-dc534-1.html