jshERP Access Control Vulnerability in PersonController Allowing Unauthorized Data Access

A vulnerability in jshERP version 3.5 has been identified, specifically within the PersonController component. This issue arises from incorrect access control, which enables unauthorized attackers to access comprehensive information about handlers by invoking the getAllList method.

Impact

Exploitation of this vulnerability allows unauthorized users to access all handler information across all accounts.

Reproduction

To reproduce this vulnerability, log into an account and navigate to the manager management section. Use a tool like Burp Suite to intercept the request. Change the request path to include the person/getAllList endpoint, remove the X-Access-Token header, and send the request. The response will contain all handler information from all accounts.