CVE-2024-27712

Vulnerability

An issue in the User Account Management component of Eskooly Free Online School Management Software version 3.0 and before allows remote attackers to enumerate valid usernames. The vulnerability occurs during the sign-up process, where the application returns distinct error messages for existing and non-existing usernames, enabling an attacker to identify teacher and admin accounts [1].

Exploitation

An attacker with network access to the Eskooly application can enumerate usernames by attempting to register accounts with different usernames and observing the error responses. Once valid usernames are identified, the attacker can leverage a separate privilege escalation vulnerability (CVE-2024-27710) to gain unauthorized access with elevated privileges, such as admin rights [1].

Impact

Successful exploitation allows an attacker to identify valid user accounts, which serves as a stepping stone for targeted attacks. Combined with CVE-2024-27710, the attacker can escalate privileges to admin level, leading to full compromise of the application. The risk is assessed as medium impact with high likelihood due to the ease of enumeration [1].

Mitigation

No official patch or fixed version has been disclosed in the available references. Users are advised to monitor vendor updates and consider implementing additional authentication controls, such as rate limiting and generic error messages, to reduce the risk of enumeration [1].