walhajri

Authorization Bypass in Solvait version 24.12.01

Description

A vulnerability in Solvait version 24.12.01 allows authenticated users to access all functions without proper authorization checks. This flaw could result in unauthorized escalation of privileges, leading to access to sensitive data or critical functionalities.

Vulnerability Details

Product Name: Solvait
Version Affected: 24.12.01 (and potentially earlier versions)
Root Cause: Lack of proper authorization checks on application functions.\

walhajri

Sensitive Information Disclosure in PrintQr Page

Description

A security flaw has been found in Solvait version 24.4.2 that exposes sensitive employee data through an unauthenticated endpoint, /Letter/PrintQr/. By manipulating the worker ID, an attacker can access the "Employee Certificate," which includes full name, organization ID, nationality, government ID, and salary information. This vulnerability impacts all employees within the company who utilize this version of the solution.

Affected target

This vulnerability was tested and found on Solvait version 24.4.2
https://<domain>/Letter/PrintQr?RequestId=<ID>&RequestLetterId=<ID>&company=<CompnayID>&worker=<ID> (worker parameter)

Severity

walhajri

Cross-Site Scripting (XSS) Vulnerability

Description:

DataTables is a table enhancing plug-in for the jQuery Javascript library, adding sorting, paging and filtering abilities to plain HTML tables with minimal effort.

This vulnerability was found during a penetration testing assessment and the website used the Datatables library.

Impact

If a website developer exposed the parameter sBaseName from the function _fnCreateCookie of the DataTables library then a malicious user could execute Javascript code through it.