Zhuimengshaonian Wisdom-Education Authorization Bypass Vulnerability in WrongBookController

An authorization bypass vulnerability has been identified in Zhuimengshaonian Wisdom-Education versions through 1.0.4. The issue resides in the WrongBookController, specifically within the WrongBook interface. The vulnerability allows attackers to access information belonging to other users by manipulating the subjectId parameter. This exploitation can be performed remotely, and a public proof-of-concept is available.

Impact

Exploitation of this vulnerability allows for horizontal privilege escalation, enabling unauthorized access to other users' information.

Reproduction

To reproduce this vulnerability, send a GET request to the /student/wrongBook endpoint. Include the subjectId parameter with a value that corresponds to another user's data. The request must also include a valid authorization token.