Liangliangyy DjangoBlog Hardcoded Amap API Key Vulnerability

A vulnerability exists in Liangliangyy DjangoBlog versions up to 2.1.0.0, where a hardcoded Amap (Gaode Maps) API key is exposed in the file owntracks/views.py. This vulnerability allows for unauthorized Amap API calls, which could lead to unexpected costs and misuse of location data. The issue can be exploited remotely without any authentication.

Impact

The hardcoded Amap API key is publicly accessible, allowing for unauthorized use of the Amap API. This could result in financial costs for the key owner and potential misuse of location data.

Remediation

It is recommended to move the Amap API key to an environment variable and rotate the exposed key immediately.