JAdmin-JAVA JAdmin Improper Authentication Vulnerability in Admin Backend Component

A critical improper authentication vulnerability has been identified in JAdmin-JAVA JAdmin version 1.0. The issue resides in the Admin Backend component, specifically within the toLogin function of the NoNeedLoginController.java file. This vulnerability allows remote access to background routes without authorization, potentially leading to unauthorized actions such as adding users or viewing logs.

Impact

Exploitation of this vulnerability allows unauthorized access to the admin backend, where super administrator privileges can be obtained. This access enables the addition of users, log management, and other administrative functions.

Reproduction

The vulnerability can be reproduced by accessing the admin backend at http://127.0.0.1:8999/admin without any login credentials. This access can be achieved by bypassing authentication restrictions, which are not enforced in this version of the application.