Fuyang Lipengjun Platform Improper Authorization Vulnerability in TopicController

An improper authorization vulnerability has been identified in Fuyang Lipengjun Platform version 1.0. The issue resides in the TopicController function within the file '/topic/queryAll'. This vulnerability allows authenticated users, regardless of their privilege level, to access data that should be restricted to administrators. The flaw can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information, allowing users to view data that should be restricted based on their role.

Reproduction

To reproduce this vulnerability, log into the application with any user account, including those with low privileges. Then, send a GET request to the '/topic/queryAll' endpoint. The server will respond with a complete list of topic information, which is typically only accessible to users with administrative privileges.