EXCELLENT INFOTEK BiYan Broken Authentication
EXCELLENT INFOTEK BiYan v2.9~v3.0 is vulnerable to a broken authentication vulnerability, which allows attackers to gain unauthorized data like user's account and password without authentication. This vulnerability affects many systems of government and company.
The injection point is "query_person_by_order.aspx".
It allows remote attackers to gain unauthorized data like user's account and password via <DEPT_ID> paramemer without authentication.
Remote attackers can gain unauthorized data like user's account and password. When accessing a victim's account, remote attackers can modifiy the password. It compromised the confidentiality, integrity and availability of data and system.
- Tony Kuo (CHT Security)