PT-2022-20142 · Unknown · Oretnom23 Automotive Shop Management System

Published 2022-05-26 · Updated 2022-06-10 · CVE-2022-30495

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions oretnom23 Automotive Shop Management System version 1.0

Description The issue concerns a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), allowing attackers to perform vertical privilege escalation by changing the admin password. This is achieved through the name id parameter.

Recommendations For oretnom23 Automotive Shop Management System version 1.0, consider restricting access to the name id parameter to prevent unauthorized changes to the admin password until a fix is available. As a temporary workaround, limit the ability to change the admin password to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-30495

Affected Products

Oretnom23 Automotive Shop Management System

References · 4

• 🔥 https://github.com/nsparker1337/OpenSource/blob/main/exploit_idor_asms.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-30495 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30495 · Vendor Advisory
• https://t.me/cibsecurity/43416 · Telegram Post