Change / view others user information

scs · Post by **scs** » Mon Jun 30, 2014 5:40 pm

Anybody test this before?

when you login to your system as normal user and try editing your own account,

eg. http : / / <<<yourdomain.com / usersedit.php ?_userid=200

then you change the 200 to any number, example 1

http : / / <<<yourdomain.com>>> / usersedit.php ?_userid=1

You're able to view and/or modify the contain even you don't have the rights.

Is this dangerous? or how to prevent this?

mobhar · Post by **mobhar** » Mon Jun 30, 2014 6:20 pm

This issue should not be happened if you have protected/enabled your "users" table with User ID Security from "Advanced Security" -> "User ID" -> "User ID Field".