CVE-2024-34323

Summary

An insecure direct object reference vulnerability in ProPhoenix Law RMS allows attackers to access sensitive user data by manipulating the usrLogin$hdnPFID parameter in HTTP requests. This means unauthorized users can potentially view confidential information belonging to other users without proper authentication.

Exploitability

The vulnerability is highly exploitable with no prerequisites, as attackers only need to craft a simple HTTP request with a modified PFID value to access other users' sensitive information.

Blast radius

If exploited, this IDOR could allow attackers to access personal and case-related data for multiple users, potentially exposing sensitive legal information across the entire system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the vendor patch for ProPhoenix Law RMS version 2022.2403.3.101 or later, as this specific version contains the fix for the IDOR vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.