CVE-2024-35353
📋 TL;DR
This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in Diño Physics School Assistant version 2.3. Attackers can manipulate the 'id' parameter in the /classes/Users.php?f=save endpoint to access or modify unauthorized user data. All users of version 2.3 are affected.
💻 Affected Systems
- Diño Physics School Assistant
📦 What is this software?
Dino Physics School Assistant by Dino Physics School Assistant Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts, including administrative accounts, leading to data theft, privilege escalation, and system takeover.
Likely Case
Unauthorized access to sensitive user information, modification of user data, and potential privilege escalation to administrative functions.
If Mitigated
Limited impact with proper authorization checks preventing unauthorized access to sensitive data.
🎯 Exploit Status
Exploitation requires at least low-privilege user access but is trivial once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Implement Proper Authorization Checks
allAdd server-side authorization validation to ensure users can only access their own data
Manual code modification required - add authorization logic in /classes/Users.php
Web Application Firewall Rule
allBlock suspicious parameter manipulation in the Users.php endpoint
WAF-specific configuration required
🧯 If You Can't Patch
- Restrict network access to the application to trusted users only
- Implement additional authentication layers and monitor for suspicious access patterns
🔍 How to Verify
Check if Vulnerable:
Test if authenticated users can access other users' data by modifying the 'id' parameter in /classes/Users.php?f=save requestsCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that authorization checks prevent users from accessing data belonging to other user IDs📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /classes/Users.php with different ID parameters
- Failed authorization attempts in application logs
Network Indicators:
- Multiple requests to Users.php endpoint with sequential or random ID values
SIEM Query:
source="web_logs" AND uri="/classes/Users.php" AND (parameter="id" AND value!="current_user_id")