Executive brief
SmartAdmin is a rapid application development platform used to build business applications. An authorization flaw in its configuration query endpoint allows low-privileged employees to retrieve sensitive system passwords that can be used to take over administrator accounts, bypassing login verification checks.
Technical details
SmartAdmin v3.30.0 contains an authorization flaw in the /support/config/queryByKey endpoint (ConfigController.java) that fails to properly validate access control. A low-privileged authenticated user can query the super_password configuration key and retrieve its plaintext value from the t_config database table. The vulnerability combines configuration disclosure with a second weakness: the login service accepts this super_password as a universal authentication credential that bypasses email verification code requirements, allowing account takeover of any administrator. Attack requires valid low-privileged employee credentials and knowledge of an administrator's login name. Patches should restrict configuration access to authorized administrators, remove the universal password authentication mechanism, and rotate exposed secrets.
Affected products
- 1024-lab SmartAdmin 3.30.0
Timeline
- 2026-09-15: disclosed