Threats affecting pkg:github/BuildAdmin

BuildAdmin versions 1.0.1 through 2.3.9 contain a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can inject javascript: URLs into the admin operation log via the X-Rewrite-URL header. When an administrator clicks the URL open button in the log, the injected script executes in the backend context and can steal the adminInfo token from localStorage, potentially leading to account takeover.

BuildAdmin versions up to 2.3.9 have an authorization bypass vulnerability that allows authenticated backend administrators with specific permissions to modify other administrators' profiles via the id parameter. This includes changing sensitive fields such as avatar, nickname, email, mobile, and motto, even for super administrators.