Stel Order IDOR Vulnerability Allowing Unauthorized Access to Employee Information

An insecure direct object reference (IDOR) vulnerability has been identified in Stel Order versions through 3.25.1. This issue resides in the '/app/FrontController' endpoint, where the 'employeeID' parameter can be manipulated. An authenticated attacker could exploit this vulnerability to retrieve personal information about employees, including first names, last names, roles, job titles, and vacation records, by altering the employeeID in requests sent to the server.

Impact

Exploitation of this vulnerability allows authenticated attackers to access sensitive information about employees, potentially leading to unauthorized data disclosure.