CVE-2023-50256
Froxlor username/surname AND company field Bypass
Impact
Dear Sirs and Madams, I would like to report a business logic error vulnerability that I discovered during my recent penetration test on Froxlor. Specifically, I identified an issue where it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements established by the system. The surname, family name AND company name all of them can be left blank. I believe addressing this vulnerability is crucial to ensure the security and integrity of the Froxlor platform. Thank you for your attention to this matter. This action served as a means to bypass the mandatory field requirements. Lets see (please have a look at the Video -> attachment). ---------------- as you can see i was able to let the username and second name blank. https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4 Lets see again. Only the company name is set. Thank you for your time  
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | froxlor/froxlor | <= 2.1.1 | 2.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Froxlor | Froxlor | before 2.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac
- https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4
- https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4
- https://github.com/advisories/GHSA-625g-fm5w-w7w4
- https://nvd.nist.gov/vuln/detail/CVE-2023-50256