PT-2019-15224 · Eyecomms · Eyecms

Ahmyth · Published 2019-11-07 · Updated 2020-08-24 · CVE-2019-17604

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions eyecomms eyeCMS versions prior to 2019-10-15

Description The issue allows any candidate to modify other candidates' personal information, including first name, last name, email, CV, phone number, and other details, by altering the id parameter. This is an Insecure Direct Object Reference (IDOR) vulnerability.

Recommendations For versions prior to 2019-10-15, as a temporary workaround, consider restricting access to the id parameter to prevent unauthorized changes to candidate information. Additionally, avoid using the id parameter in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-17604

Affected Products

Eyecms

References · 4

• 🔥 https://gist.github.com/AhMyth/b0f7e4b8244def8eb8d7d8c61fa6d4e5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-17604 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17604 · Vendor Advisory
• http://eyecomms.com/Products/eyeCMS.html · Vendor Advisory