Roncoo Roncoo-Pay Improper Authentication Vulnerability

A vulnerability exists in Roncoo Roncoo-Pay versions up to 9428382af21cd5568319eae7429b7e1d0332ff40, specifically in an unknown function of the file '/user/info/list'. This vulnerability allows for improper authentication, enabling unauthorized access to user information. The issue can be exploited remotely without any authentication requirements.

Impact

Exploitation of this vulnerability bypasses authentication mechanisms, allowing unauthorized users to access functionalities or information that should be restricted.

Reproduction

To reproduce this vulnerability, send a GET or POST request to the '/user/info/list' endpoint without any authentication or authorization. The request will be processed, and access to the user list functionality will be granted, demonstrating the improper authentication flaw.