DinoRANK Missing Authorization Vulnerability Allowing Invoice Access

A missing authorization vulnerability in DinoRANK, an SEO tool, allows attackers to access any user's invoices by exploiting an endpoint that lacks proper access controls. The PDF filenames can be discovered through open-source intelligence, unencrypted network traffic, or brute force methods.

Impact

Exploitation of this vulnerability allows unauthorized access to user invoices, potentially leading to exposure of sensitive financial information.

Remediation

The DinoRANK team has fixed this vulnerability in the latest version.