Anapi Group h6web Insecure Direct Object Reference Vulnerability Allowing User Impersonation

An insecure direct object reference (IDOR) vulnerability has been identified in Anapi Group's h6web application, which is used for managing guilds and online payments. This vulnerability allows an authenticated attacker to access information belonging to other users by sending a POST request and altering the 'pkrelated' parameter in the '/h6web/ha_datos_hermano.php' endpoint to target another user. Additionally, this exploitation could enable the attacker to impersonate other users, causing all subsequent requests to be executed with the privileges of the impersonated user.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user information and the ability to impersonate other users within the application.

Remediation

The Anapi Group team has disabled the insecure direct object reference vulnerability in the latest version of the h6web application.