T05 · Unauthorized Access and Privilege Escalation
Error
- Location
api/routes/logistics_routes.js:18- Finding
Public API permits unauthorized access, mutation, and CRM synchronization
- Content
View full analysis
{ try { const recordData = req.body; const result = await logisticsAPI.createLogisticsRecord(recordData); res.status(201).json({ success: true, data: result }); } catch (e) { res.status(400).json({ success: false, error: e.message }); } }); router.get('/', async (req, res) => { try { const filters = req.query; const result = await logisticsAPI.listLogisticsRecords(filters); res.json({ success: true, data: result }); } catch (e) { res.status(500).json({ success: false, error: e.message }); } }); router.get('/:id', async (req, res) => { try { const logisticsId = req.params.id; const result = await logisticsAPI.getLogisticsDetails(logisticsId); if (!result) { return res.status(404).json({ success: false, error: 'Logistics record not found' }); } res.json({ success: true, data: result }); } catch (e) { res.status(500).json({ success: false, error: e.message }); } }); router.put('/:id/status', async (req, res) => { try { const logisticsId = req.params.id; const { newStatus, syncToOKKI } = req.body; const result = await logisticsAPI.updateLogisticsStatus( logisticsId, newStatus ); if (syncToOKKI) { try { await autoNotificationService.autoNotifyOnStatusChange( logisticsId, newStatus, true ); } catch (notifyError) { console.warn('Automatic notification failed:', notifyError.message); } } res.json({ success: true, data: result }); } catch (e) { res.status(400).json({ success: false, er ...[truncated 3260 chars]- Remediation
View remediation