Lucas SOLERA luluhackme

## CVE-2024-44786.md

      
        
          
            
              
              1 file
            
          
          
            
              
              0 forks
            
          
            
              
                
                0 comments
              
            
          
            
              
              0 stars
            
          
        
        
          
              
          
          
            
                luluhackme
                / CVE-2024-44786.md
            
            
              Last active
              December 4, 2024 20:23
            
          
        
      
        

      
      
    CVE-2024-44786 : IDOR in "E-commerce Extension" of Meabilis CMS 1.0 exposing users PII

An IDOR in Address Management Book of the "E-commerce Extension" affecting previous version of Meabilis CMS allowed an attacker to expose PII of all users who registered on a website which used Meabilis. The patched version was automatically released to all affected websites.
PoC:

Create an account on one of the website which use Meabilis CMS
Go to the endpoint : /mbCore/users/contacts/load,form.html?contactsId=randomID
Change randomID with a random number
You can view all users PII including full name, address, phone and email.