0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ENTAB ERP 1.0 - Username PII leak Vulnerability
Author
Risk
[Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
Exploit Title: ENTAB ERP 1.0 - Username PII leak Exploit Author: Deb Prasad Banerjee Vendor Homepage: https://www.entab.in Version: Entab ERP 1.0 Tested on: Windows IIS CVE: CVE-2022-30076 Vulnerability Name: Broken Access control via Rate Limits Description: In the entab software in fapscampuscare.in, there is a login portal with a UserId field. An authenticated user would enter and get their name as well as other services. However, there should be a rate limit in place, which is not present. As a result, a hacker could bypass the system and obtain other usernames via broken access control. This enables a threat actor to obain the complete full name and user ID of the person. POC: 1. Go to fapscampuscare.in or any entab hosted software and find the entab software. 2. Use a proxy to intercept the request. 3. Since it's a student login, try a random UserId (e.g., s11111). 4. Intercept the request using Burp Suite and send it to the Intruder. 5. Select payloads from number 100000-20000, and turn off URL encoding on the UserId parameter. 6. Start the attack and sort by length to obtain the username and full name of other users. # 0day.today [2024-11-15] #