Skip to content

Instantly share code, notes, and snippets.

@NSW111

NSW111/CVE-2025-52101 Secret

Last active July 1, 2025 08:34
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save NSW111/33824ceb4d1b920671124f77abfe27e8 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save NSW111/33824ceb4d1b920671124f77abfe27e8 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
CVE-2025-52101
[CVE ID]
CVE-2025-52101
[PRODUCT]
Linjiashop
[VERSION]
<= 0.9
[PROBLEM TYPE]
Incorrect Access Control
[DESCRIPTION]
Linjiashop version 0.9 and below is vulnerable to Incorrect Access Control. By using a default-generated JWT token, attackers can bypass authentication and access the /prod-api/account/info endpoint. This leads to the disclosure of sensitive information including encrypted passwords and salts. The leaked data (e.g., MD5(salt + password)) can be brute-forced to recover the original password.
[DISCOVERER]
Jiamu Gao (@nsw111)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment