CyberRota Analysis
AI-GeneratedThe vulnerability affects TDuck survey forms up to version 5.3, where inadequate validation of webhook URLs allows authenticated attackers to link their webhooks to other users' forms. This flaw enables the exfiltration of form submissions to unauthorized external or internal destinations, posing a significant risk to user data confidentiality. Organizations using TDuck should prioritize remediation to mitigate potential data breaches and protect user information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.