AdaptCMS IDOR Exploit: Change Passwords Like a Boss!
IDOR “Change Password” Functionality in adaptcmsv3.0.3 lets users with low privileges channel their inner hacker, altering admin passwords with the finesse of a cat burglar armed with a keyboard. Just a few clicks and voila, you’re the new admin! Security? Who needs it when you’ve got IDOR’s magic touch?
Hot Take:
So, it turns out that AdaptCMS has a password change feature that’s more open than a 24-hour drive-thru! With a little IDOR magic, you too can have admin access faster than you can say “security breach”—because who needs pesky things like user permissions anyway?
Key Points:
- Andrey Stoykov discovered an Insecure Direct Object Reference (IDOR) vulnerability in AdaptCMS version 3.0.3.
- The vulnerability allows low-privilege users to change the password of higher-privilege accounts, like the admin.
- This exploit was tested on a Debian 12 system.
- The exploit involves intercepting a POST request and altering user ID values.
- The vulnerability can potentially allow unauthorized access to sensitive areas of the CMS.
Already a member? Log in here