IDURAR ERP CRM Accounting Software Vulnerability

CVE-2024-47769

What is CVE-2024-47769?

The vulnerability in IDURAR ERP CRM software arises from its corePublicRouter.js file, where the public endpoint fails to enforce authentication. This flaw permits an unauthenticated user to exploit the system by injecting URL-encoded malicious payloads into the join statement, which is executed without sufficient validation. Consequently, an attacker can manipulate the directory structure, potentially gaining unauthorized access to sensitive system files by appending an encoded payload at a subpath location. Such vulnerabilities underscore the importance of implementing stringent input validation and user authentication mechanisms.

References