UBICOD Medivision Digital Signage Authorization Bypass Vulnerability Allowing Privilege Escalation

A vulnerability in UBICOD Medivision Digital Signage version 1.5.1 has been identified, allowing normal users to bypass authorization and escalate privileges. This is achieved by manipulating the 'ft[grp]' parameter and sending a GET request to the '/html/user' endpoint. The vulnerability enables users to gain super admin rights without authentication.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, granting normal users super admin rights.

Reproduction

To reproduce this vulnerability, send a GET request to the '/html/user' page with the 'ft[grp]' parameter set to '3'. This can be done using a web browser or a tool like curl or Postman.