Skip to content
ביקורת אבטחה
חזרה ללוח
D14אומת חיP1

`ajax_get_map`/`ajax_get_state` unauthenticated seat-state read

B · unauth-POSTS1 · read-onlySECT1
תיקון
90%
מורכבות low200

Anyone can read live seat-state data through the open endpoint without logging in.

Seater.php:114,124

תיק מלא
ממצאים קשורים
D13 · God-router: no nonce + no capability …D45 · `ajax_seat_state` lets an anonymous u…D46 · `ajax_reassign_seat` has no capabilit…D48 · Seat reservation race (read-check-wri…D87 · `ajax_seat_state` block() insert has …D54 · `luc1ph3r` keyless Feistel = QR/gate …