hustoj IDOR Vulunerability

[logag1]

描述问题
IDOR Vulunerability (Improper Data Deletion) in /thread.php?tid={TID}

如何复现
Users can access deleted posts by manipulating the tid value
For example, even if a thread corresponding to tid 1 is created and deleted, it is still accessible by manipulating url query
/thread.php?tid=1

Expected behavior
The deleted thread should not be accessible

Screenshots

SERVER OPTION
CSL HUSTOJ (release 24.01.30)
Modified by CSL 2025
GPLv2 licensed by HUSTOJ 2025

target: every device

[zhblue]

thank you for reporting!
try update thread.php to lateast.

[logag1]

If it turns out to be a valid vulnerability, can I get a CVE id?

[zhblue]

I don't know how to give you one.

[logag1]

But there's a case CVE-2022-42187

[zhblue]

sorry for unfamiliar with the rules of sec， still don't know what ToDo to confirm your contibution.
maybe you can give us a patch pull request , and I will merge it ?

[logag1]

I don't use php very well. I just saw the possibility of a vulnerability and reported it, but if it's not valid, you can ignore it. Sorry again for not being helpful....

[zhblue]

You are helping , the latest code is patched, just tell the administrator of the site you are using to update "thread.php"

[zhblue]

If you can help us translate the new added English words into Korean , that will be even helpful.
https://github.com/zhblue/hustoj/blob/master/trunk/web/lang/ko.php

[logag1]

Oh, was it a patched vulnerability? sry
If you tell me how to translate Korean, I will help you

[zhblue]

first , fork this project
second, edit it in your fork, just replace the English value in quotes with Korean.

after save all the changes, create a pull request.

just browse the homepage of your fork, github might show a big green button for you to do it .