BOLD Workplanner Insecure Direct Object Reference Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in BOLD Workplanner versions prior to 2.5.25. This vulnerability arises from insufficient validation of user input, enabling authenticated users to access basic contract details using unauthorized internal identifiers.

Impact

Exploitation of this vulnerability allows unauthorized access to basic contract details of employees, including personal information such as names, national identity numbers, and various employment records, using internal identifiers that should not be accessible.

Remediation

Users can upgrade to BOLD Workplanner version 2.5.25 to address this vulnerability.