CVE-2026-111705
CVE-2026-111705 · Fuint through commit 57ec018 IDOR via bookId in myBookDetail
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile numbers, in-store verification codes, service dates, stores and remarks.
CVSS 5.3 · Mittel · EPSS 0,3%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
fuint
- Softwareversionen
- ≥ 0, ≤ 57ec01895e22dd93f16f493db30a77a7c1b148f2: Betroffen (git)
Keine Korrektur veröffentlicht
Originalquellen
- https://hackmd.io/@hieuPenguinnn/fuint-booking-detail-idor
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientBookController.java#L252-L265
- https://github.com/fushengqian/fuint/blob/57ec01895e22dd93f16f493db30a77a7c1b148f2/fuint-application/src/main/java/com/fuint/common/service/impl/BookItemServiceImpl.java#L237-L258
- https://www.vulncheck.com/advisories/fuint-through-commit-57ec018-idor-via-bookid-in-mybookdetail
- https://nvd.nist.gov/vuln/detail/CVE-2026-111705