Description
jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jishenghua | jshERP | ≤ 3.6 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- VulnCheck Advisory: jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList third-party-advisory