medium5.3
CVE-2022-44005
An issue was discovered in BACKCLICK Professional 5.9.63.
Impact
An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vulnerable to the enumeration of subscribers' e-mail addresses. Furthermore, it is possible to subscribe and verify other persons' e-mail addresses to newsletters without their consent.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Backclick | Backclick | Version 5.9.63 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-026.txt
- https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-026.txt
- https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037