POC详情： 8efac87b07565b2533d37574323980ba1ecf273d

来源
https://github.com/geraldoalcantara/CVE-2023-49982
关联漏洞
标题： School Fees Management System 安全漏洞 (CVE-2023-49982)
描述：School Fees Management System是一个学费管理系统。 School Fees Management System v1.0 版本存在安全漏洞，该漏洞源于 /admin/management/users 中的访问控制被破坏。
描述
School Fees Management System v1.0 - Incorrect Access Control - Privilege Escalation
介绍
# CVE-2023-49982
# School Fees Management System v1.0 - Incorrect Access Control - Privilege Escalation

**Description**: Broken access control in School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts.

**Vulnerable Product Version**: School Fees Management System v1.0  
**CVE Author**: Geraldo Alcântara  
**Date**: 29/11/2023  
**Confirmed on**: 15/12/2023  
**CVE**: CVE-2023-49982  
**Tested on**: Windows  
**Affected Components**:
> /ci_fms/admin/management/class  
> /ci_fms/admin/management/term  
> /ci_fms/admin/management/users  
> /ci_fms/admin/management/settings  
### Steps to reproduce:  
Unauthorized access to any page of the application and performing unrestricted actions is possible. To exploit the vulnerability, an attacker must log in as a user and directly access administrative URLs like http://{IP}/ci_fms/admin/management/users, executing desired actions.

Discoverer(s)/Credits:  
Geraldo Alcântara
文件快照

 [4.0K]  /data/pocs/8efac87b07565b2533d37574323980ba1ecf273d
└── [1.0K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。