DM Corporative CMS IDOR Vulnerability in Private Area Access

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in DM Corporative CMS, versions prior to 2025.01. This vulnerability enables an attacker to access the private area by manipulating the option parameter in a specific administrative data management endpoint.

Impact

Exploitation of this vulnerability allows unauthorized access to the private area of the application.

Reproduction

To reproduce this vulnerability, send a request to the '/administer/select node/data.asp' endpoint with the 'mode' parameter set to 'catalogue', 'id1' and 'id2' set to '1', and 'networks' set to '0'. Include the 'option' parameter with a value of '0', '1', or '2'.

Remediation

Users are advised to update to DM Corporative CMS version 2025.01.