Tutorials-Website Employee Management System update-user.php improper authorization

Vulnerability

The Employee Management System (EMS) version 1.0 by Tutorials-Website contains an Insecure Direct Object Reference (IDOR) vulnerability in the file /admin/update-user.php. The endpoint does not properly verify authorization before processing the ID parameter, allowing any remote user to access and modify user records without authentication. The vendor was contacted but did not respond [1].

Exploitation

An attacker can exploit this vulnerability by directly accessing the /admin/update-user.php endpoint without any prior authentication or session. By manipulating the ID parameter, the attacker can update any user's account details, including admin accounts. The exploit has been publicly disclosed and does not require any special privileges or user interaction [1].

Impact

Successful exploitation leads to unauthorized data access, data manipulation, account takeover, privilege escalation, and potential denial of service. An attacker can gain full administrative control over the system, compromising all user data and company operations. This can result in reputation damage and regulatory consequences [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The vendor was contacted but did not respond. Users should consider disabling or restricting access to the /admin/update-user.php endpoint until a fix is available. The application may be considered end-of-life if no update is provided [1].