CyberRota Analysis
AI-GeneratedA broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to access and download invoice PDF files containing sensitive customer personally identifiable information (PII) via an unsecured router. This flaw enables attackers to enumerate MongoDB ObjectIds, facilitating unauthorized access to any invoice in the system. Organizations using this version of the software should prioritize remediation to protect customer data and mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can enumerate MongoDB ObjectIds to download any invoice in the system without credentials.