doramart DoraCMS Improper Authentication Vulnerability in Email API

An improper authentication vulnerability has been identified in doramart DoraCMS version 3.0.x, specifically within the Email API component. The issue arises from an unknown processing in the file '/api/v1/mail/send', allowing remote exploitation without the need for authentication. This vulnerability could be exploited to send emails using the attacker's own email address, potentially leading to unauthorized information dissemination.

Impact

Exploitation of this vulnerability allows for improper authentication, where the application fails to adequately verify the identity of a user or process. This could be misused to send emails on behalf of the attacker, using their own email address.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/api/v1/mail/send' endpoint of the affected DoraCMS application. The request must include a 'tempkey' parameter, and the 'info' object should contain the email content, including the title, message, and target email address. The response will indicate a successful email dispatch.