Insecure Direct Object Reference in DeporSite Affects T-INNOVA Products

CVE-2025-41069

What is CVE-2025-41069?

An Insecure Direct Object Reference vulnerability exists in DeporSite by T-INNOVA. This issue allows attackers to gain unauthorized access to or modify sensitive resources. By manipulating the 'idUsuario' parameter within the AJAX call to '/ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos', an attacker could potentially expose or alter confidential data, leading to serious security breaches. Proper access controls must be implemented to safeguard against this vulnerability.

References