E4 Sistemas Mercatus ERP ID Resource Injection Vulnerability

A resource injection vulnerability has been identified in E4 Sistemas Mercatus ERP version 2.00.019. The issue arises in an unknown function of the file '/basico/webservice/imprimir-danfe/id/', where improper control of resource identifiers allows for unauthorized access to sensitive information. This vulnerability can be exploited remotely without authentication, by manipulating the ID parameter to access invoices belonging to other users.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive data, specifically purchase invoices from other users.

Reproduction

To reproduce this vulnerability, send a request to the '/basico/webservice/imprimir-danfe/id/' endpoint with a specific ID. The response will include the invoice associated with that ID. By changing the ID to another value, it is possible to access invoices belonging to other users.