Elunez Eladmin Deserialization Vulnerability in Maintenance Management Module

A deserialization vulnerability has been identified in Elunez Eladmin version 2.7, specifically within the Maintenance Management Module. The issue arises in the file '/api/database/testConnect', where untrusted data is deserialized without proper validation, potentially leading to unauthorized data manipulation. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary file reading on the server, which could lead to unauthorized information disclosure.

Reproduction

To reproduce this vulnerability, access the '/api/database/testConnect' endpoint with a crafted input that exploits the deserialization flaw. This can be done remotely, and the available proof-of-concept exploit may be used as a reference.