Missing Authentication In IDAttend’s IDWeb Application

Vulnerability

The DeleteStaff method in IDAttend's IDWeb application version 3.1.013 lacks authentication checks. This allows any unauthenticated attacker to send a crafted request to the endpoint and delete staff records without requiring any special configuration or prior access [1].

Exploitation

An attacker only needs network access to the IDWeb application. No authentication or user interaction is required. The attacker can directly call the DeleteStaff method with the target staff identifier, causing immediate deletion of that staff member's data [1].

Impact

Successful exploitation results in the deletion of staff information from the application's database. This leads to loss of data integrity and availability, potentially disrupting staff management operations. The attacker does not gain any elevated privileges beyond the ability to delete records [1].

Mitigation

The vulnerability is fixed in IDWeb version 3.1.053. Users should upgrade to this version or later. No workarounds are documented in the available reference [1].