high7.5Public exploit code
CVE-2020-35737
In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIn…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Newgen Correspondence Management System (corms) eGov 12.0 - IDOR2021-01-06 · webapps · multiple
Impact
In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the unvalidated UserIndex parameter, aka Insecure Direct Object Reference.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Newgensoft | Egov | Version 12.0 |
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html
- https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486
- https://www.exploit-db.com/exploits/49378
- http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html
- https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486
- https://www.exploit-db.com/exploits/49378