IDExpert Vulnerability Allows Remote Execution of OS Commands

CVE-2024-10653

Summary

A command injection vulnerability exists in IDExpert, a product from CHANGING Information Technology, due to inadequate validation of a specific parameter in the administrator interface. This oversight can be exploited by remote attackers who possess administrative privileges, enabling them to inject and execute operating system commands on the server. Such exploitation can have severe implications for system security, potentially leading to unauthorized data access and manipulation.

References