medium5.3Public exploit code
CVE-2022-30076
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ENTAB ERP 1.0 - Username PII leak2023-04-08 · webapps · asp
Impact
ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Entab | Erp | Version 1.0 |