Zentao Pms
Monthly
Authenticated privilege-management weakness in EasySoft ZenTao PMS through 22.6 allows a low-privileged user to manipulate the group argument handled by userModel::checkGroupChange in module/user/model.php, potentially gaining improper group-related privileges. The flaw is remotely reachable but requires a valid low-privilege account; assessed impacts are limited to low confidentiality, integrity, and availability effects with no scope change. No public exploit was identified at time of analysis, and the vendor did not respond to the disclosure.
Authenticated privilege-management weakness in EasySoft ZenTao PMS through 22.6 allows a low-privileged user to manipulate the group argument handled by userModel::checkGroupChange in module/user/model.php, potentially gaining improper group-related privileges. The flaw is remotely reachable but requires a valid low-privilege account; assessed impacts are limited to low confidentiality, integrity, and availability effects with no scope change. No public exploit was identified at time of analysis, and the vendor did not respond to the disclosure.