Kaifangqian Kaifangqian-Base Information Disclosure Vulnerability in SysUserController

A vulnerability allowing information disclosure has been identified in Kaifangqian Kaifangqian-Base versions prior to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. The issue arises in the 'getAllUsers' function of the SysUserController.java file. This vulnerability can be exploited remotely, allowing unauthorized access to sensitive user information.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive user information, causing a breach of confidentiality.

Reproduction

To reproduce this vulnerability, send a GET request to the '/sys/user/getAllUsers' endpoint. Include a valid access token in the 'X-Access-Token' header. The response will contain user information from the database, which should not be accessible without proper authorization.