Exploits / Vulnerability Discovered : 2020-10-06 |
Type : webapps |
Platform : json
This exploit / vulnerability Easypms 1.0.0 authentication bypass is for educational purposes only and if it is used you will do on your own risk!
EasyPMS has authentication bypass vulnerability that low privilege user can escalate privilege to HotelOwner admin privilege.
Steps to Reproduce:
1)
Unprivileged user can manipulate sql query within json request format. Admin user code can be obtained using single quote after ID column so
that where clause is invalid.
2)
While user is sending password resetting request, can change password of Admin user that is inside HotelOwner privilege class.
Because there is not validation of token and user has write permission on STDUSER table so admin user password can be changed by unprivileged user that obtains ID of admin user
sending first request.