Description

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-02T01:17:24.060Z",
  "pubdate": "2026-09-02T01:17:24.060Z",
  "executiveSummary": "A critical vulnerability has been identified in the edit_personal endpoint of the gouguoa application, affecting versions up to 5.10.0 and 6.0.1.\nThe flaw stems from an insecure implementation that allows for the dynamic modification of object attributes via the position_id argument.\nThis vulnerability is classified as a dynamic property injection issue, which can be leveraged by remote, unauthenticated, or authenticated attackers—depending on endpoint accessibility—to manipulate internal application objects.\nThe risk implication involves unauthorized modification of data structures, potentially leading to privilege escalation, data integrity compromise, or remote code execution depending on the application's underlying architecture.\nPublicly disclosed exploit code currently exists, significantly increasing the probability of active exploitation.\nImmediate remediation is required, and users are advised to upgrade the affected software to version 6.0.3 to mitigate the underlying security flaw.",
  "technicalDetails": "The vulnerability resides within the update function located in app/home/controller/Index.php. The root cause is the improper handling of user-supplied input during the assignment of object properties.\nSpecifically, the application takes the position_id argument from the user request and uses it to perform dynamic attribute assignment on an internal object. Because the application fails to validate or sanitize the input against an allow-list of authorized properties, an attacker can supply crafted input to overwrite sensitive class attributes.\nThe attack flow begins with the attacker identifying the edit_personal endpoint. By manipulating the position_id parameter, the attacker can influence the object state during the update process. In many PHP-based environments, if user-controlled input is passed directly into a dynamic setter or an object property assignment, it may allow for object injection or property pollution.\nThis behavior allows the attacker to alter the intended logic of the application. For instance, by overwriting authentication-related flags, user IDs, or administrative privileges stored within the affected object, an attacker can bypass authorization mechanisms or gain elevated permissions.\nSince this is a remote-exploitable vulnerability, the attacker does not require physical access to the server. The payload behavior involves sending a modified HTTP request to the target endpoint, where the malicious input is processed by the update function. The resulting state change is persistent within the session or the underlying data store, depending on the scope of the affected object.\nGiven that the exploit has been disclosed publicly, the barrier to entry for potential threat actors is low. The impact of successful exploitation is significant, potentially resulting in full application compromise, unauthorized data exfiltration, or the disruption of critical business logic. The vulnerability specifically affects the application's ability to maintain secure object state integrity, making it a high-priority security concern for deployments utilizing versions prior to 6.0.3."
}