PassJava-Platform Incorrect Access Control Vulnerability Allowing Information Disclosure

A vulnerability exists in PassJava-Platform version 3.0.0 due to incorrect access control in the scheduleLog info API component. This flaw allows attackers to bypass authentication and access sensitive information by sending a crafted payload. The vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive information.

Reproduction

To reproduce this vulnerability, send a POST request to the '/renren-fast/sys/scheduleLog/info/1' endpoint. This request must include a valid JSESSIONID cookie. The request will be denied due to authentication requirements. However, if the payload is sent to '/renren-fast/sys/login;/../scheduleLog/info/1', the authentication can be bypassed, allowing access to the sensitive information.