Scada-LTS Information Disclosure Vulnerability in WatchListDwr Endpoint

A vulnerability in Scada-LTS version 2.7.8.1 allows authenticated users with low privileges to access sensitive information such as usernames, emails, phone numbers, and admin status. This information disclosure issue could be exploited for phishing, privilege escalation, or social engineering attacks.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive user information, including contact details and admin status, which could be used for targeted attacks or to escalate privileges within the application.

Reproduction

To reproduce this vulnerability, authenticate as a low-privileged user and send a POST request to the '/Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr' endpoint. The response will contain sensitive information about all users in the system, including admin details.