This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A critical authorization flaw in ImpressCMS. π **Consequences**: Attackers bypass security limits to steal sensitive user info or access restricted features. It's a direct breach of trust!
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: Incorrect access control logic in `/include/findusers.php`. π **Flaw**: The system fails to properly verify if a user has permission to view specific data, allowing unauthorized reads.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: ImpressCMS versions **before 1.4.3**. π **Component**: Specifically the `findusers.php` module. If you are running an older version, you are at risk!
Q4What can hackers do? (Privileges/Data)
π **Attacker Actions**: - **Data Theft**: Access sensitive user information. - **Privilege Escalation**: Bypass security tokens. - **Unauthorized Ops**: Modify data or execute actions without permission.β¦
β‘ **Threshold**: **LOW**. πͺ **Auth**: Remote exploitation possible. No local access needed. βοΈ **Config**: Exploits a logic error in a core file, making it easy to trigger via HTTP requests.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exp?**: **YES**. π **PoC**: Available via Nuclei templates and PacketStorm. π **Wild Exp**: Reported on HackerOne, meaning real-world exploitation is confirmed and documented.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: - Scan for ImpressCMS instances. - Check version number (must be < 1.4.3). - Look for `/include/findusers.php` endpoint. π οΈ **Tool**: Use Nuclei with the specific CVE template for quick detection.
π§ **No Patch?**: - **WAF Rules**: Block access to `/include/findusers.php`. - **Access Control**: Restrict file permissions on the server. - **Network**: Limit exposure of the CMS to trusted IPs only.β¦
π₯ **Urgency**: **HIGH**. π¨ **Priority**: Immediate action required. Since PoCs are public and it involves data leakage, patching to v1.4.3+ is critical to protect user data and system integrity.