Das Parking Management System Sensitive Data Exposure Vulnerability

A sensitive data exposure vulnerability has been identified in Das Parking Management System version 6.2.0. The issue arises from an unknown function in the file '/Operator/FindAll', which allows unauthorized access to sensitive user information. This vulnerability can be exploited remotely without authentication, posing a significant security risk as it enables the retrieval of all user account credentials, which can be decrypted for direct login access.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive user data, specifically account credentials, which can be decrypted and used for login.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/Operator/FindAll' endpoint. This request can be made without authentication and will return sensitive user data, including account credentials.