YFexam-exam-1.9.2 has interface leakage

[LvZCh]

Source Code Developer: Beijing Yunfan Internet Technology Co., Ltd
Source code name：yfexam-exam
Source code version：1.9.2
Source code official website：https://www.jeedocm.com/?plan=githuby
Source code download link：https://github.com/qiutiandefeng/yfexam-exam/archive/refs/heads/main.zip

Vulnerability description：
The doc.html path in src/main/java/com/yf/exam/config/ShiroConfig.java does not have access permissions set, resulting in unauthorized viewing of all interfaces

Code Audit：
The doc.html path in src/main/java/com/yf/exam/config/ShiroConfig.java does not have access permissions set

Vulnerability verification：
Open directly without logging in: http://192.168.0.106:8101/doc.html


Open directly without logging in: http://192.168.0.106:8101/v2/api-docs?group=考试模块接口