Jrohy Trojan Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Jrohy Trojan versions 2.0.0 through 2.15.3. The issue arises in the web application's initialization interface at '/auth/register', where improper handling of user input allows remote attackers to modify the administrator password without authorization.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the administrator password, potentially leading to unauthorized administrative access.

Reproduction

To reproduce this vulnerability, send a POST request to the '/auth/register' endpoint with the desired password. The request will be processed by the 'updateUser' function, which extracts the password and updates the administrator password in the application's database.