CVE-2020-25566

In SapphireIMS 5.0, it is possible to take over an account by sending a request to the SavePassword form as shown in POC. Notice that we do not require a JSESSIONID in this request and can reset any user’s password by changing the username to that user and password to base64desired password...

SapphireIMS 访问控制错误漏洞

Tecknodreams SapphireIMS is an ITIL 2011 certified Enterprise Service Management System from Tecknodreams India. A security vulnerability exists in SapphireIMS 5.0, which stems from the software's Save Password form not filtering requests enough to allow an attacker to send a request to take over...

PT-2021-11153

Name of the Vulnerable Software and Affected Versions: SapphireIMS version 5.0 Description: The issue allows for account takeover by sending a request to the "Save Password" form. This can be done without requiring a JSESSIONID, enabling the reset of any user's password by modifying the username ...