Description
EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elektraweb | EasyPMS | 1.0.0 | — |
References
- ExploitDB-48858 exploit
- Vendor Homepage product
- VulnCheck Advisory: EasyPMS 1.0.0 - Authentication Bypass third-party-advisory