Zhengfang Education Authority (c01) account can bypass Privilege Escalation

Fang educational administration lower version elevation of authority after c01, you can submit the complete authority Fang educational administration system lower version explosion Elevation of Privilege Vulnerability :( http://www.bkjia.com/Article/201304/200666.html) and this similar, first use this login, can only view the classroom use,, you can add the following code to bypass Privilege Escalation <li> Role Switching:

<A id = "aJs" href = "javascript :__ doPostBack ('ajs','') "> instructor </a>

 

<Li> In addition, after changing aJs to aBm, you can switch back and forth to obtain the permission of ipvc01. When switching to a instructor user, it seems that you can log on to the instructor account as needed. Solution:

Upgrade the educational administration system. The latest visitor version is the html interface.