macrozheng mall-swarm Improper Authorization Vulnerability in Read History Deletion

A vulnerability allowing improper authorization has been identified in macrozheng mall-swarm versions through 1.0.3. The issue arises in the delete function of the /member/readHistory/delete endpoint, where the ids parameter can be manipulated to delete read history entries of other users without authorization. This vulnerability can be exploited remotely, leading to unauthorized deletion of user data.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of read history entries, disrupting access controls and integrity of user data.

Reproduction

To reproduce this vulnerability, log in as a user and capture the request made when deleting read history. Modify the ids parameter to include IDs from another user and send the request. The read history for the other user will be deleted without authorization.