Agenzia Impresa Eccobook Insecure Direct Object Reference Vulnerability Allowing Unauthorized Document Access

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the PdfHandler component of Agenzia Impresa Eccobook, affecting versions through 2.81.1. This vulnerability allows unauthenticated attackers to access confidential documents by manipulating the DocumentoId parameter, which is an incrementing integer associated with each uploaded document.

Impact

Exploitation of this vulnerability could lead to unauthorized access to confidential documents.

Reproduction

To reproduce this vulnerability, access the PdfHandler.ashx endpoint and include a guessable DocumentoId parameter. The IDs can be brute-forced, as they increment with each document upload. This can be done manually or with an automated script.