SOUND4 Impact, First, Pulse, and Eco Authorization Bypass Vulnerability via Insecure Direct Object References

A vulnerability allowing authorization bypass through insecure direct object references has been identified in SOUND4 products, including the Impact, First, Pulse, and Eco versions through 2.x. This vulnerability allows attackers to access hidden system resources and execute privileged functions without proper authentication. The issue arises from the application’s handling of user-supplied input, which can be manipulated to bypass authorization controls.

Impact

Exploitation of this vulnerability could lead to unauthorized access to privileged functionalities and hidden system resources, allowing for potential privilege escalation.

Reproduction

The vulnerability can be reproduced by sending a request to the application with manipulated user input that exploits the insecure direct object reference. This can be done through various user-accessible interfaces that the application provides.