Missing Authentication In IDAttend’s IDWeb Application

Vulnerability

The IDAttend IDWeb application version 3.1.052 and earlier fails to enforce authentication on the SearchStudents method, allowing unauthenticated access to sensitive student data [1]. Affected versions include 3.1.013 (discovered) and all prior builds up to 3.1.052 [1].

Exploitation

An attacker with network access to the IDWeb application can directly call the SearchStudents method without any form of authentication or prior session [1]. No user interaction or elevated privileges are required. The exact request parameters are not disclosed in the available reference.

Impact

Successful exploitation leads to the exposure of sensitive student data, including personally identifiable information (PII) [1]. The attacker gains the ability to extract data without authorization, resulting in a confidentiality breach with potential privacy and regulatory repercussions.

Mitigation

The vulnerability has been fixed in IDWeb version 3.1.053 [1]. Organizations running IDWeb 3.1.052 or earlier should upgrade to version 3.1.053 or later immediately. No workarounds are documented in the reference.