JIZHICMS Improper Authorization Vulnerability in Account Profile Page

A vulnerability allowing improper authorization has been identified in JIZHICMS versions through 1.7.0. The issue resides in the Account Profile Page, specifically within the file '/user/userinfo.html'. The vulnerability is triggered by manipulating the 'jifen' argument, leading to unauthorized access or actions. This issue can be exploited remotely, and details of the exploitation are publicly available.

Impact

Exploitation of this vulnerability allows for unauthorized modification of user data, specifically the 'jifen' value on the account profile page.

Reproduction

To reproduce this vulnerability, send a POST request to '/user/userinfo.html' with the 'jifen' parameter set to a desired value. The response will reflect the modified 'jifen' value, demonstrating the unauthorized access control.