Idurar Erp Crm
Monthly
Insecure Direct Object Reference in IDURAR ERP CRM through v4.1.1 allows any authenticated administrator to overwrite the password of any other administrator account by supplying an arbitrary account identifier in the URL path of the password-update endpoint. The backend handler resolves the target account from the caller-controlled path parameter rather than the session token, and the two are never compared, enabling full account takeover of peer administrators. No public exploit has been identified at time of analysis, but the logic flaw is mechanically straightforward for any holder of a valid administrator token.
Unauthenticated remote access to invoice PDFs in IDURAR ERP CRM 4.1.0 and earlier exposes customer PII due to the /download Express router being mounted globally without authentication middleware, constituting a broken access control flaw (CWE-284). Any internet-reachable attacker can retrieve financial documents by enumerating MongoDB ObjectIds, requiring no credentials, session token, or user interaction. No active exploitation has been confirmed via CISA KEV, and no public exploit code is identified in the available intelligence, though the attack requires only basic HTTP requests and ObjectId pattern knowledge.
Insecure Direct Object Reference in IDURAR ERP CRM through v4.1.1 allows any authenticated administrator to overwrite the password of any other administrator account by supplying an arbitrary account identifier in the URL path of the password-update endpoint. The backend handler resolves the target account from the caller-controlled path parameter rather than the session token, and the two are never compared, enabling full account takeover of peer administrators. No public exploit has been identified at time of analysis, but the logic flaw is mechanically straightforward for any holder of a valid administrator token.
Unauthenticated remote access to invoice PDFs in IDURAR ERP CRM 4.1.0 and earlier exposes customer PII due to the /download Express router being mounted globally without authentication middleware, constituting a broken access control flaw (CWE-284). Any internet-reachable attacker can retrieve financial documents by enumerating MongoDB ObjectIds, requiring no credentials, session token, or user interaction. No active exploitation has been confirmed via CISA KEV, and no public exploit code is identified in the available intelligence, though the attack requires only basic HTTP requests and ObjectId pattern knowledge.