DDSN Interactive cm3 Acora CMS Improper Access Control Vulnerability Allowing Account Takeover

A vulnerability has been identified in DDSN Interactive cm3 Acora CMS version 10.1.1, where improper access control allows editor-privileged users to access sensitive information, including system administrator credentials. This is achieved by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files, such as 'cm3.xml', attackers can bypass access controls, potentially leading to account takeover and privilege escalation.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information, such as administrator credentials, allowing for account takeover and privilege escalation.