Quequnlong Shiyi-Blog Improper Authorization Vulnerability in Photo Album Access

A critical vulnerability has been identified in Quequnlong Shiyi-Blog versions through 1.2.1. The issue resides in the '/dev-api/api/album/photos/{albumId}' interface, where improper authorization allows users to access confidential photos without password verification, jeopardizing user privacy. This vulnerability can be exploited remotely, and an exploit is publicly available.

Impact

Exploitation of this vulnerability allows unauthorized access to private photo albums, enabling users to view confidential photos without proper authentication.

Reproduction

To reproduce this vulnerability, upload files through the '/api/file/upload' endpoint using directory traversal techniques to bypass authorization. After uploading, access the '/dev-api/api/album/photos/{albumId}' endpoint to retrieve photos from albums without password verification.