Summary
Multiple vulnerabilities could allow unauthenticated attackers to bypass rate-limiting measures for login attempts, or check for the existence of other users. Low-privileged users can modify certain site content without authorization.
Details
Per OPEXUS:
The vulnerability has been addressed and resolved in the June 2025 release, version 11.12.3.0
CAPTCHA Bypass - Resolved
SQL Injection - Resolved
Email HTML Injection - Resolved
https://docs.opexustech.com/docs/foiaxpress/11.12.0/FOIAXpress_Release_Notes_11.12.3.0.pdf
Vulnerabilities 3
-
Medium 5.3
OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.
-
Medium 5.3
OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place.
-
Medium 4.3
OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification
OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.
Revision history
-
#1.1.1
Updated title
-
#1.1.0
Updated SSVC
-
#1.0.0
Initial publication