zj1983 zz Vertical Privilege Escalation Vulnerability

A critical vertical privilege escalation vulnerability has been identified in zj1983 zz versions through 2024-8. This vulnerability allows attackers to misuse the privileges of regular users to alter, delete, or add information related to administrators. The issue can be exploited remotely and has been publicly disclosed.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain administrative privileges, enabling them to modify, delete, or add administrator-related information.

Reproduction

To reproduce this vulnerability, create a low-privilege user account. Once the account is set up, obtain the session cookie for the user. With this cookie, send a request to the 'UserDelete' endpoint, targeting an administrator account. The request should include the necessary headers to mimic a legitimate user action. If successful, the administrator account will be deleted, demonstrating the privilege escalation.