Missing Authentication In IDAttend’s IDWeb Application

Vulnerability

The StudentPopupDetails_Timetable method in IDAttend's IDWeb application versions 3.1.052 and earlier lacks authentication checks. This allows any unauthenticated attacker to access the endpoint and retrieve sensitive student data. The vulnerability was discovered in version 3.1.013 [1].

Exploitation

An attacker can send a crafted HTTP request to the vulnerable endpoint without any authentication. No special network position or user interaction is required. The attacker simply needs to know the endpoint URL or discover it through enumeration.

Impact

Successful exploitation results in the extraction of sensitive student data, leading to unauthorized disclosure of personal information. The impact is primarily on confidentiality, with no direct effect on integrity or availability.

Mitigation

The issue is fixed in IDWeb version 3.1.053 [1]. Users should upgrade to this version or later. No workarounds are mentioned in the available references.