cms
cms copied to clipboard
liufee
FeehiCMS version 2.1.1 - Parameter Tampering for Read-Only Username Parameter
[Parameter Tampering for Read-Only Parameter]
Severity Score: Low
CVSS Score: 3.5 Low, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Description
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as “read-only.” An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes.
Impact
This can lead to unintended username changes.
POC
Register two users, user1 and user2.
Login as backend user, navigate to the user module.
Observe that the username is readonly.
Update the user record. Below is the original request.
Modified request, added username parameter.
The readonly username was changed.
Remediation
- Omit the affected parameter in server side.
- Validate only whitelisted parameters are allowed for user updates.
