FlyCms Missing Authorization in ActionService.counter()

Executive Summary

FlyCms has a missing authorization flaw in ActionService.counter() where authenticated users can modify other users' content rows. The checkRowOwner function fails to verify ownership, allowing any registered user to send requests to endpoints like /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose. This lets attackers add arbitrary deltas to numeric fields such as price, stock, or points.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized modifications to user content by monitoring requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose endpoints. Look for unexpected changes in numeric fields like price, stock, or points in the database.

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate product prices, inventory levels, or user points by exploiting this flaw. This could lead to financial losses, incorrect stock reporting, or unfair advantages in user accounts. The impact depends on the specific use of FlyCms in your environment.

Useful 0 Not Useful 0

Mitigation Strategies

Apply input validation to ensure only authorized users can modify content. Implement proper ownership checks in ActionService.counter() to prevent unauthorized access. Restrict access to the vulnerable endpoints to authenticated users only.

Useful 0 Not Useful 0