NCH Express Accounts Privilege Escalation via IDOR (CVE-2020-13474)

Critical Vulnerability Information CVE Number: CVE-2020-13474 Affected Software: NCH Express Accounts Vulnerability Type: Privilege Escalation Affected Versions: 8.24 and earlier Vulnerability Author: Tejas Nitin Pingulkar Exploit Available: Yes Software Description Express Accounts is a professional business accounting software, ideal for small businesses needing to record and report cash flow for income and expenses, including sales, receipts, payments, and purchases. Detailed Information The software allows network access. The web interface provides three types of users: - Administrator - User - Viewer Administrator users can access all modules, including creating new invoices, creating new quotes, creating new sales orders, creating new purchase orders, applying customer payments, viewing credit notes, entering new accounts payable, viewing account charts, making payments, receiving payments, adding new items, adding new products, viewing supplier lists, and adding/editing users. Users with viewer privileges cannot access the above functions via forced browsing. We will use viewer user privileges to access administrative modules. Exploitation Method The following users were created for proof-of-concept: - Administrator user: admin@tejas.com - Viewer user: lowuser@tejas.com Exploit URLs

Goal Reached Thanks to every supporter — we hit 100%!

NCH Express Accounts Privilege Escalation via IDOR (CVE-2020-13474)