otale Tale Blog Improper Authentication Vulnerability in Admin Logs API

An improper authentication vulnerability has been identified in otale Tale Blog version 2.0.5. This issue allows unauthorized access to the admin logs API, bypassing the login requirement. The vulnerability resides in the file '/%61dmin/api/logs' and can be exploited remotely. It is important to note that this version of the software is no longer supported by the maintainer.

Impact

Exploitation of this vulnerability allows unauthorized users to access sensitive administrative log data, potentially including administrator account passwords, thereby creating a permission verification issue.

Reproduction

Accessing the '/%61dmin/api/logs' endpoint directly bypasses authentication, revealing sensitive log information. This can be done remotely without any login credentials.