Technical impact
The vulnerability is an insecure direct object reference in the UpdateProfile action of SysProfileController. An authenticated user can set the phone number of any other user, including an administrator, by specifying an arbitrary UserId. By controlling the administrator’s phone number, an attacker can request an SMS code through /checkMobile and log in with /PhoneLogin, thereby taking over the administrator account. This flaw effectively allows privilege escalation and full account takeover without any need for elevated privileges.
Affected Systems
The affected product is the Zr.Admin.NET web application, specifically the SysProfileController and its associated SysLoginController. The issue exists in commits ranging from af07ffc through eb9228a. Administrator accounts and other user profiles are at risk when the application runs with these commits; any authenticated user can exploit the IDOR.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity vulnerability. While the EPSS score is not available, the lack of a KEV listing does not diminish the risk, as the flaw can be leveraged by any authenticated user without complex prerequisites. The likely attack vector is an internal or compromised user account, as the exploit requires authentication to call the update endpoint. Once the phone number is changed, the attacker can bypass standard authentication flows by receiving an SMS code and logging in as the target user, resulting in full control of that account.
