NesterSoft WorkTime Broken Access Control Vulnerability Allowing Database Configuration Reset

A vulnerability exists in NesterSoft WorkTime on-premises versions through 11.8.8, allowing any unauthenticated user to reset the database configuration by sending a specific HTTP request to the WorkTime server. This issue arises from a lack of authorization checks, enabling unauthorized users to manipulate the application's database settings.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition by resetting the application's database configuration, which can disrupt normal operations and functionality.

Reproduction

To reproduce this vulnerability, send an unauthenticated HTTP request to the WorkTime server with the specific endpoint that resets the database configuration. The request can be crafted using a tool like curl or Postman, ensuring that no authentication tokens are included.