T05 · Unauthorized Access and Privilege Escalation
Error
- Location
api/routes/okki_routes.js:12- Finding
Unauthenticated HTTP Endpoints Can Modify OKKI CRM Records
- Content
View full analysis
{ try { const complaintId = req.params.id; if (!complaintId) { return res.status(400).json({ success: false, message: 'Complaint ID cannot be empty' }); } const result = await okkiSyncController.syncComplaintToOKKI(complaintId); if (result.success) { res.status(200).json(result); } else { res.status(400).json(result); } } catch (error) { console.error('Failed to synchronize complaint to OKKI:', error); res.status(500).json({ success: false, message: 'Server error', error: error.message }); } }); /** * @route POST /api/after-sales/repeat-order/:id/sync-okki * @desc Synchronize a repeat-order quotation to OKKI * @access Public */ router.post('/repeat-order/:id/sync-okki', async (req, res) => { try { const repeatOrderId = req.params.id; if (!repeatOrderId) { return res.status(400).json({ success: false, message: 'Repeat-order ID cannot be empty' }); } const result = await okkiSyncController.syncRepeatOrderToOKKI(repeatOrderId); if (result.success) { res.status(200).json(result); } else { res.status(400).json(result); } } catch (error) { console.error('Failed to synchronize repeat order to OKKI:', error); res.status(500).json({ success: false, message: 'Server error', error: error.message }); } }); ``` ### Technical Analysis Both POST routes are explicitly documented as public and invoke operations that create follow-up records in the O ...[truncated 1726 chars]- Remediation
View remediation