Quequnlong Shiyi-Blog Improper Authentication Vulnerability in Administrator Backend

A critical vulnerability allowing improper authentication has been identified in Quequnlong Shiyi-Blog versions through 1.2.1. The issue resides in the Administrator Backend, specifically within the '/api/sys/user/verifyPassword/' endpoint. This vulnerability can be exploited remotely, bypassing password verification and potentially allowing unauthorized access to the admin interface.

Impact

Exploitation of this vulnerability allows attackers to bypass authentication and access the administrator backend, undermining the application's access control mechanisms.

Reproduction

To reproduce this vulnerability, send a GET request to the '/api/sys/user/verifyPassword/' endpoint with a password parameter. The response will indicate a successful authentication bypass, allowing access to the admin backend.