Description
jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jishenghua | jshERP | ≤ 3.6 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- VulnCheck Advisory: jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel third-party-advisory