GHSA-qgc9-p7cj-jvh6
FeehiCMS fails to enforce server-side immutability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | feehi/feehicms | 2.1.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes.
References
External links from the advisory. They lead to third-party sites.