Description
UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| UBICOD Co., Ltd. | MEDIVISION | UBICOD Medivision Digital Signage | Firmware 1.5.1 (2013.01.3) | — |
References
- ExploitDB-48684 exploit
- UBICOD Co., Ltd. | MEDIVISION INC. product
- Zero Security Advisory ZSL-2020-5575 vendor-advisory
- VulnCheck Advisory: UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges third-party-advisory