Itwanger Paicoding Improper Authorization Vulnerability in Article Handler Allowing Unauthorized Access to User Data

A critical vulnerability has been identified in Itwanger Paicoding version 1.0.3, specifically within the Article Handler component. The issue arises in the file '/article/api/post', where improper authorization allows for unauthorized manipulation of articles. This vulnerability can be exploited remotely, with the potential for significant impact.

Impact

Exploitation of this vulnerability could lead to unauthorized access and modification of user articles, including the deletion of articles from the original author's account.

Reproduction

To reproduce this vulnerability, an administrator account can publish an article without review. A regular user can then create an article and use the '/article/api/post' interface to overwrite an article belonging to the administrator by changing the article ID to one of theirs. This action will delete the administrator's article, demonstrating horizontal privilege escalation.