Description
Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| izhaorui | Zr.Admin.NET | — | — |
References
- https://vul.yulun.ac.cn/20261114/zr-admin-net/ third-party-advisory
- https://github.com/izhaorui/Zr.Admin.NET/issues/27 issue-tracking
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/Content/FrontArticleController.cs#L122-L148 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Service/Content/ArticleService.cs#L402-L437 technical-description
- VulnCheck Advisory: Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API third-party-advisory