CVE-2024-13111 Details

A critical vulnerability has been identified in version 1.9.2 of the Yunfan Learning Examination System by Beijing Yunfan Internet Technology. The issue resides in the JWT Token Handler component, specifically within the SysUserControl file. The vulnerability allows for improper authentication, as the system's JWT tokens can be exploited universally across any server using this application. The flaw arises because the application does not properly validate JWT tokens during the login process. As a result, an attacker can replace the existing JWT with a crafted token that bypasses authentication and grants administrative privileges.