HexBrain

ExpressionEngine · Report #338477

[EE] change the author of post using the author_id

Validstatus
lowseverity
11upvotes
20 Apr 2018disclosed

Summary

@flex0geek discovered that users with permission to edit entries in the control panel could manipulate the form or POST submission and set an invalid author as the author of that entry. @flex0geek gave a detailed report with step-by-step instructions for replicating and screen captures of a their results, enabling a speedy resolution to the issue, which was to add additional validation on submission so that the new author would only be accepted if that author is allowed to be an author of the entry.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original