PT-2021-21627 · Southsoft · Southsoft Gmis

Caiteli · Published 2021-08-06 · Updated 2021-08-13 · CVE-2021-37381

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Southsoft GMIS version 5.0

Description The issue allows attackers to access other users' private information, such as photos, through CSRF attacks. For example, any student's photo information can be accessed through the "/gmis/(S([1]))/student/grgl/PotoImageShow/?bh=[2]" endpoint. The code in [1] is a random string generated according to the user's login-related information, which can protect the user's identity but cannot effectively prevent unauthorized access. The code in [2] is the student number of any student. The attacker can carry out a CSRF attack on the system by modifying [2] without modifying [1].

Recommendations As a temporary workaround, consider restricting access to the /gmis/(S([1]))/student/grgl/PotoImageShow/?bh=[2] endpoint until a patch is available. Avoid using the bh parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-37381

Affected Products

Southsoft Gmis

References · 7

• 🔥 https://github.com/caiteli/poc_information/issues/1 · Exploit
• 🔥 https://github.com/caiteli/poc_information/blob/main/southsoft_GMIS.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-37381 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37381 · Vendor Advisory
• https://t.me/cvenotify/18773 · Telegram Post
• https://t.me/cvenotify/19320 · Telegram Post
• https://t.me/cibsecurity/26927 · Telegram Post