CyberRota Analysis
AI-GeneratedOpnForm is vulnerable due to its use of sequential row identifiers and Hashids with an empty default salt, enabling unauthenticated attackers to predict and compute hashes for any submission. This flaw allows attackers to access and read full submission data from other users or overwrite existing submissions through the submission-fetch and answer endpoints. Organizations utilizing OpnForm should prioritize addressing this critical vulnerability to protect sensitive user data and maintain the integrity of their submission processes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.