CyberRota Analysis
AI-GeneratedLubeLogger versions prior to 1.6.8 are vulnerable to a flaw that allows authenticated users to exploit the DuplicateRecordsToOtherVehicles endpoint, enabling them to copy sensitive records from other users into vehicles they control. This vulnerability can lead to unauthorized access to service, maintenance, and personal data, posing significant privacy and security risks. Organizations utilizing LubeLogger should prioritize upgrading to version 1.6.8 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user could edit. The endpoint authorized the destination vehicles but fetched source records in Controllers/VehicleController.cs without checking UserCanEditVehicle for each existingRecord.VehicleId. This missing source-vehicle authorization allowed service, collision, upgrade, fuel, tax, supply, note, odometer, reminder, plan, inspection, and equipment records belonging to another user to be copied into an attacker-controlled vehicle, exposing record contents and attachment paths and creating persistent copies. This issue is fixed in version 1.6.8.