Adobe Connect 10 Username Disclosure

`# Title: adobe connect 10 Local Route Disclosure  
# Author: h4shur  
# date:2021-02-07  
# Vendor Homepage: https://www.adobe.com  
# Software Link: https://www.adobe.com/products/adobeconnect.html  
# Version: 10 and earlier  
# Tested on: Windows 10 & Google Chrome  
# Category : Web Application Bugs  
  
  
### Description :  
  
*There are many web applications in the world, each of which has  
vulnerabilities due to developer errors, and this is a problem for all of  
them, and even the best of them, like the "adobe connect" program, have  
vulnerabilities that occur every month. They are found and fixed by the  
team.  
*With the disclosure of the admin username, one of the most important steps  
in the field of targeted hacking can be taken, and as a result, the hacker  
can more easily achieve his desire, which may be destruction or ransomware  
attack or infection.  
  
*Given the vulnerability that was released some time ago (  
https://cxsecurity.com/issue/WLB-2021010128), a hacker with these two  
vulnerabilities can make significant progress in his targeted hacking.  
  
*For example, by finding the admin username, the hacker can go to the next  
step of his targeted hacking only by cracking the password or other ways.  
And if it encounters a problem at this stage, it can solve the problem at  
this stage of the hack by knowing the previous vulnerability (  
https://cxsecurity.com/issue/WLB-2021010128).  
Of course, in addition to obtaining a username and password, you also need  
access to the admin panel.  
Protecting your username and password and hiding the admin panel is one of  
the most important ways to increase security, which unfortunately is  
largely the case.  
I hope that by writing this research, an important step in security can be  
taken.  
  
*By adding this (/system/help/support) to the end of the desired website  
address, you can view the username without any filter or obstacle.  
Sometimes even without a username and password.  
And by adding (/system/login) to the end of the desired website address,  
you can access the admin panel without any filters.  
  
  
### POC :  
site.com/system/help/support  
  
### Admin Panel :  
site.com/system/login  
  
  
### demo :  
https://vc.shdu.ac.ir/system/help/support  
  
### demo admin panel :  
https://vc.shdu.ac.ir/system/login?domain=vc.shdu.ac.ir&next=%2Fadmin%3Fdomain%3Dvc.shdu.ac.ir&set-lang=en&OWASP_CSRFTOKEN=3716d2ba0e5af4b7b2f630670e95d51e13481223818b70951ffcd2f343860bf8  
  
  
### thanks to :  
the shdu.ac.ir site for reviewing it  
and all my friends  
  
### contact me :  
* Telegram : @h4shur  
* Email : [email protected]  
* Instagram : @netedit0r / @h4shur  
* twitter : @h4shur / @netedit0r  
`