OPEXUS eCasePortal Unauthenticated Insecure Direct Object Reference Vulnerability

An insecure direct object reference vulnerability has been identified in OPEXUS eCasePortal versions prior to 9.0.45.0. This vulnerability allows an unauthenticated attacker to access the 'Attachments.aspx' endpoint, manipulate predictable 'formid' values, and either download or delete user-uploaded files, or upload new files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to, modification, or deletion of user-uploaded files.

Remediation

Users can upgrade to OPEXUS eCasePortal version 9.0.45.0 or later to address this vulnerability.