Description
Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| izhaorui | Zr.Admin.NET | — | — |
References
- https://vul.yulun.ac.cn/20261114/zr-admin-net/ third-party-advisory
- https://github.com/izhaorui/Zr.Admin.NET/issues/27 issue-tracking
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysProfileController.cs#L62-L75 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.ServiceCore/Services/SysUserService.cs#L220-L236 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysLoginController.cs#L516-L559 technical-description
- https://github.com/izhaorui/Zr.Admin.NET/commit/af07ffc5d18e7876d3780d1ff5ee776b80950399 technical-description patch
- VulnCheck Advisory: Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile third-party-advisory