Object Injection in Gouguoa CMS via edit_personal Endpoint

Executive Summary

This is a mass assignment privilege escalation vulnerability in GouGuOA (勾股OA) versions up to 5.10.0. It affects the edit_personal endpoint in the app/home/controller/Index.php file. The flaw allows an authenticated attacker with low privileges to inject an arbitrary position_id value, such as setting it to 1, which grants maximum RBAC privileges. This enables full access to backend management functions like user management and system configuration.

Useful 0 Not Useful 0

Detection Guidance

Check if your system is running gouguoa versions up to 5.10.0 or 6.0.1 by inspecting the version in the application or server logs. Look for requests to the /home/index/edit_personal endpoint with parameters including position_id. Monitor for unusual privilege escalation events or unauthorized access to administrative functions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a low-privileged employee account could exploit this to escalate privileges and gain full access to administrative features. This includes managing users, system configurations, departments, and RBAC settings. The attack can be executed remotely and requires only low privileges and no user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade gouguoa to version 6.0.3 or later immediately. If upgrading is not possible, restrict access to the /home/index/edit_personal endpoint and validate all position_id inputs to prevent mass assignment attacks. Ensure low-privileged users cannot modify sensitive attributes.

Useful 0 Not Useful 0