CVE-2024-34323

ProPhoenix Law RMS v2022.2403.3.101 is vulnerable to an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This flaw allows an attacker to perform a crafted HTTP request to gain unauthorized access to sensitive information . The vulnerability is associated with CWE-639 (A...

CVE-2024-34326

The ProPhoenix Law RMS v2022.2403.3.101 software contains a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the errorHandler.aspx endpoint, specifically triggered via the PageTitle , Alert , or MsgType parameters. Exploitation details and specific remediation instructions a...

CVE-2024-34320

ProPhoenix Law RMS version v2022.2403.3.101 contains an incorrect access control issue within its sensitive API endpoints . This vulnerability could potentially allow unauthorized access to restricted data or functions. No specific remediation steps, exploit details, or technical root causes are ...

CVE-2024-34321

The software ProPhoenix Law RMS v2022.2403.3.101 is affected by a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the Notes.aspx endpoint, specifically triggered through the PageTitle/Notes parameter. No specific exploitation details, impact metrics, or remediation steps ar...

CVE-2024-34319

A Server-Side Request Forgery SSRF in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request...

CVE-2024-34324

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NETSessionId cookie...

CVE-2024-34324

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NETSessionId cookie...

CVE-2024-34319

A Server-Side Request Forgery SSRF in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request...