Listen to this Post
How the CVE Works:
The vulnerability exists in API endpoints (e.g., /api/getUserProfile, /api/getProject) of Primakon Pi Portal v1.0.18. These endpoints use client-supplied parameters like `user_id` or `project_id` to retrieve specific records. The server fails to validate if the authenticated user is authorized for the requested object ID. For Direct ID Manipulation, an attacker simply changes the numeric ID value in a legitimate request to access another user’s data. For Filter Omission, endpoints that should use a parameter like `filter_by_user` return all records in the database when that parameter is removed entirely. This occurs because the backend query executes without a proper WHERE clause, dumping the entire table contents. The lack of server-side access checks on both object-level and dataset-level queries leads to mass data exposure.
dailycve form:
Platform: Primakon Pi Portal
Version: 1.0.18
Vulnerability: Authorization Bypass IDOR
Severity: Critical
date: 2025-11-25
Prediction: Patch 2025-12-15
What Undercode Say:
curl -H "Authorization: Bearer <token>" https://target/api/getUserProfile?user_id=5 curl -H "Authorization: Bearer <token>" https://target/api/getUserProfile?user_id=6 curl -H "Authorization: Bearer <token>" https://target/api/getProjects The last request omits a user filter, potentially returning all projects.
How Exploit:
- Attacker intercepts valid API request for own profile (ID=5).
- Attacker modifies `user_id` parameter to 6 in the request.
- Server responds with sensitive data (email, details) of user 6.
- For data dump, attacker calls `/api/getAllRecords` or similar without required filter parameters.
- Server responds with JSON array containing all user/project records.
Protection from this CVE:
Implement server-side authorization checks.
Use indirect reference maps (session-based).
Reject requests missing mandatory filters.
Apply principle of least privilege.
Impact:
Mass data leakage.
Privacy violation.
Potential further attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
