Myphr
Monthly
SIMAC MyPHR 1.1 exposes an insecure direct object reference (IDOR) in its employee-update API that lets any authenticated user with a valid low-privileged account access and modify arbitrary employee records. By sending a PUT request with another employee's identifier and a controlled password value, an attacker can take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information such as private pay bulletins. Publicly available exploit code exists, and the vulnerability has a CVSS 4.0 base score of 8.7; active exploitation has not been confirmed by CISA KEV status in the provided data.
SIMAC MyPHR 1.1 exposes an insecure direct object reference (IDOR) in its employee-update API that lets any authenticated user with a valid low-privileged account access and modify arbitrary employee records. By sending a PUT request with another employee's identifier and a controlled password value, an attacker can take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information such as private pay bulletins. Publicly available exploit code exists, and the vulnerability has a CVSS 4.0 base score of 8.7; active exploitation has not been confirmed by CISA KEV status in the provided data.