BOLD Workplanner Insecure Direct Object Reference Vulnerability

A Insecure Direct Object Reference (IDOR) vulnerability exists in BOLD Workplanner by Global Planning Solutions, in versions prior to 2.5.25. This vulnerability allows authenticated users to access sensitive contract details by exploiting inadequate validation of user input. The issue arises from the use of unauthorized internal identifiers, enabling access to information such as employee data and contract dates.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive employee and contract information, including personal identifiers and attendance records, through the misuse of internal identifiers.

Remediation

Users are advised to update BOLD Workplanner to version 2.5.25 or later.