EUVD-2026-44839
GHSA-f4xv-85hg-mw5r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible IDOR requiring a low-privilege authenticated session (PR:L); partial C and I impacts for cross-customer data access and modification; no realistic availability impact from parameter substitution alone.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/add.php. The manipulation of the argument kd_cs leads to authorization bypass. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authorization bypass in RafyMrX TOKO-ONLINE-ROTI allows a low-privileged remote attacker to manipulate the kd_cs parameter in proses/add.php to access or modify data belonging to other customers, a classic CWE-639 Insecure Direct Object Reference pattern. The application up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 is confirmed affected, with no vendor patch available after the vendor failed to respond to responsible disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity of parameter manipulation makes this trivially reproducible with standard HTTP tooling.
Technical ContextAI
TOKO-ONLINE-ROTI is a PHP-based online bakery/bread-shop web application developed by RafyMrX and identified via CPE cpe:2.3:a:rafymrx:toko-online-roti:*:*:*:*:*:*:*:*. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a subclass of IDOR (Insecure Direct Object Reference), where the application accepts a user-supplied customer identifier - the kd_cs argument - in proses/add.php without verifying that the requesting user is authorized to act on the referenced customer record. The application trusts the client-controlled key rather than binding operations to the server-side session identity. This is a common PHP anti-pattern where row-level access control is absent and the object reference is exposed directly in the HTTP request parameter.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure. Immediate remediation requires adding server-side authorization enforcement in proses/add.php that validates the submitted kd_cs value against the authenticated session's user identity before processing any add operation - the fix must reject any request where the customer key does not belong to the authenticated user. As a compensating control, operators can restrict access to proses/add.php via web server configuration (e.g., require a specific role cookie or session attribute validated server-side) to reduce the exploitable surface. Replace user-supplied kd_cs parameter lookups with session-bound customer identifiers that cannot be enumerated or substituted by the client; this eliminates the IDOR surface entirely. Monitoring web access logs for anomalous or enumerated kd_cs parameter sequences can help detect exploitation attempts in the interim. See https://vuldb.com/vuln/379368 for the original report.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today