CVE-2023-30550

MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the workspace. An attacker can obtain some...

CVE-2023-30550

MeterSphere (open source continuous testing platform) contains an IDOR vulnerability that lets a project administrator modify other projects within the same workspace, potentially escalating privileges to obtain operating permissions. The issue is fixed in version 2.9.0. Affected component: proje...

CVE-2023-30550: Authorization Bypass Through User-Controlled Key

MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the workspace. An attacker can obtain some...

PT-2023-22777

Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.9.0 Description The issue is an IDOR vulnerability that allows the administrator of a project to modify other projects under the workspace, potentially granting an attacker some operating permissions. MeterSpher...

WCFM Membership < 2.11.0 - Unauthenticated Arbitrary Password Update via IDOR

The plugin allows unauthenticated attackers to update the password of arbitrary account via an IDOR attack, which could allow them to gain access to high privilege ones such as administrator...

projectSend r1605 Private File Download

Exploit Title: projectSend r1605 - Private file download Application: projectSend Version: r1605 Bugs: IDOR Technology: PHP Vendor URL: https://www.projectsend.org/ Software Link: https://www.projectsend.org/ Date of found: 24-01-2023 Author: Mirabbas Ağalarov Tested on: Linux Technical Details &...

CVE-2023-1125 Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR

The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own...

HackerOne: Insecure Direct Object Reference (IDOR) - Delete Campaigns

An insecure direct object reference IDOR vulnerability was discovered on a website, which allowed an attacker to delete any campaign based on the campaign ID. By modifying the campaign ID parameter in the request, an attacker could delete campaigns on any program. This vulnerability could have...

projectSend r1605 - Private file download Vulnerability

Exploit Title: projectSend r1605 - Private file download Application: projectSend Version: r1605 Bugs: IDOR Technology: PHP Vendor URL: https://www.projectsend.org/ Software Link: https://www.projectsend.org/ Date of found: 24-01-2023 Author: Mirabbas Ağalarov Tested on: Linux Technical Details &...

Unikrn: An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashier

Vulnerability description not provided...

Mars: ████ ' can add animal to other account ' at ██████

The report indicates that a vulnerability was discovered that allowed an individual to add animals to other user accounts. The vulnerability was addressed by Cyber Defense...

WordPress JetPack Plugin < 9.8 IDOR Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:automattic:jetpack"; if description...

CVE-2023-1129 WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR

The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users...

WS-2023-0132

In alf.io before 2.0-M4-2304, an IDOR Vulnerability allows the owner of one Organization can update any other organization in...

WS-2023-0120

In alf-io before 2.0-M4-2304 an IDOR Vulnerability allows the owner of one Organization can edit, delete and resetpassword users that belong to other organization...

WS-2023-0124

An IDOR Vulnerability in alfio-event/alf.io prior to 2.0-M4-2304 allows the owner of one Organization can disable users that belong to other organization...

Mars: ████ ' can change any account email and cannot retrieve his account and access it ' at ███

The security vulnerability described a method to change the email address of any user account, preventing the original user from accessing their account. The vulnerability involved manipulating the user profile update functionality to modify the email address. Despite an error message when...

IDOR make users can delete others' subscription

Proof of Concept 1 user1 create subscription1 2 user2 create subscription2 3 user2 delete subscription2 4 user2 use burpsuite hiajck the request 5 the request URL can be DELETE /inlong/manager/api/consume/delete/2 6 change the request :DELETE /inlong/manager/api/consume/delete/1 1 is the id of...

IDOR make users can bind any cluster

Proof of Concept 1 admin create cluster1, cluster2, clusterTag1 and clusterTag2 2 admin add user1 as owner of cluster1,clusterTag1 3 user1 bind clusterTag1 to cluster1 4 user1 use burpsuite hiajck the request 5 the request content can be "clusterTag":"biaoqia4","bindClusters":1 6 change the reque...

Mars: ███████ ' can delete any animal from other account ' at ██████████

The ██████████ website was found to have an Insecure Direct Object Reference IDOR vulnerability that allowed authenticated users to delete animals belonging to other users' accounts. This vulnerability arose due to the system's failure to properly validate and restrict access to protected resourc...