Insecure Direct Object Reference in Anapi Group's H6Web

CVE-2025-1270

What is CVE-2025-1270?

The h6web product by Anapi Group is affected by an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated attackers to access other users' private information. This flaw is exploited through manipulation of the 'pkrelated' parameter in the '/h6web/ha_datos_hermano.php' endpoint, enabling attackers to make POST requests to view another user's data. Moreover, the initial exploitation allows the attacker to impersonate other users, leading to further unauthorized privileges on subsequent requests.

References