CVE-2018-16606

In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and their authors' personal information (Name, Email, Organization, and Position) by changing the value of Paper ID (the pid parameter).

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2018-09-06

Last modified

2024-08-05

Weaknesses

CWE-639

Affected products

• Proconf (Proconf)

References

• https://blog.ziaurrashid.com/idor-on-proconf-peer-reviewand-conference-management-system/
• https://packetstormsecurity.com/files/149259/IDOR-On-ProConf-Peer-Review-And-Conference-Management-6.0-File-Disclosure.…