Sricam DeviceViewer Password Change Security Bypass Vulnerability

A password change security bypass vulnerability has been identified in Sricam DeviceViewer version 3.12.0.1. This vulnerability allows authenticated users to change passwords without properly validating the old password. By injecting a large payload into the old password parameter during the password change process, attackers can bypass the validation and set an arbitrary new password.

Impact

Exploitation of this vulnerability allows for arbitrary password changes, potentially leading to unauthorized access.

Reproduction

To reproduce this vulnerability, log into the Sricam DeviceViewer application as a registered user. Navigate to 'System Tools' and select 'Change Password'. Inject a large payload into the 'old password' field and enter a desired new password. After submitting the change, restart the application and log in with the new password to confirm the change.