Veris · Report #120293
Critical IDOR - Get Authentication Details of any Terminal/Gatekeeper
Validstatus
4upvotes
12 Jun 2016disclosed
How it was found
Hello Team,
I have found a critical IDOR using which an attacker can get authentication details of any gatekeeper/terminal remotely by just changing the value of gatekeeper/terminal id.
Proof of Concept: Please find it attached.
Best Regards,
Hely H. Shah