COMMAX Biometric Access Control System Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in COMMAX Biometric Access Control System version 1.0.0. This vulnerability allows unauthenticated attackers to access sensitive information and bypass physical controls in smart homes and buildings by exploiting cookie poisoning. Attackers can forge cookies to bypass authentication and access confidential data.

Impact

Exploiting this vulnerability bypasses authentication, allowing unauthorized access to sensitive information and the ability to circumvent physical controls in smart homes and buildings.

Reproduction

The vulnerability can be reproduced by forging cookies to include specific values that bypass authentication checks. Once the cookies are set, an unauthenticated request can be made to the application, such as requesting the 'db_dump.php' file, which will return sensitive information like SQL backups.