CyberRota Analysis
AI-GeneratedThe SIMAC MyPHR 1.1 application is vulnerable due to an insecure direct object reference (IDOR) flaw that permits authenticated attackers to manipulate any employee record without proper ownership validation. This vulnerability can lead to unauthorized account takeovers, enumeration of employee records, and exposure of sensitive personally identifiable information, including private pay bulletins. Organizations utilizing this application should prioritize remediation to protect against potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.