Description
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| redaxo | core | < 5.21.5 | 5.21.5 |
References
- GitHub Security Advisory (GHSA-phjc-vx3j-58r3) vendor-advisory
- VulnCheck Advisory: REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables third-party-advisory