VetBosSel Fingerprint Attendance security bypass |
NAME
VetBosSel Fingerprint Attendance security bypass
- Platforms Affected:
VetBosSel Fingerprint Attendance 1.0 - Risk Level:
9.8 - Exploitability:
Proof of Concept - Consequences:
Bypass Security
DESCRIPTION
VetBosSel Fingerprint Attendance could allow a remote attacker to bypass security restrictions, caused by an unverified password change in the /fingerprint/src/register.php script. By sending a specially-crafted POST request using the id, firstname, lastname, username, password, and type parameters, an attacker could exploit this vulnerability to reset the password of any user and obtain administrative access.
CVSS 3.0 Information
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Access Vector: Network
- Access Complexity: Low
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Remediation Level: Unavailable
MITIGATION
No remedy available as of March 29, 2022.
- Reference Link:
https://packetstormsecurity.com/files/166510 - Reference Link:
https://www.vetbossel.in/fingerprint-attendance-project-php/
If you like the site, please consider joining the telegram channel and supporting us on Patreon using the button below.
