CVE-2024-34323 in RMS
Summary
by MITRE • 10/13/2026
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The discovery of an insecure direct object reference within ProPhoenix Law RMS version 2022.2403.3.101 highlights a critical failure in server-side access control mechanisms, specifically concerning the usrLogin$hdnPFID parameter. This vulnerability classifies under CWE-639, which describes situations where an application exposes a reference to an internal implementation object, such as a file, directory, or database key, without ensuring that the authenticated user is authorized to access that specific resource. In this context, the PFID likely serves as a primary identifier for client records, case files, or sensitive legal documents stored within the RMS system. The flaw arises because the application relies on client-supplied input to determine which object to retrieve, rather than verifying whether the current session has permission to view that particular ID. This architectural oversight allows an attacker who possesses valid credentials for one user account to manipulate the PFID parameter in HTTP requests and subsequently access data belonging to other users or unrelated entities within the system.
From a technical perspective, this vulnerability manifests during the authentication or post-authentication workflow where the usrLogin$hdnPFID value is processed by the backend logic. When an attacker crafts an HTTP request with a modified PFID value, such as incrementing or decrementing sequential identifiers, the server fails to perform adequate authorization checks before returning the requested data. This behavior enables unauthorized information disclosure, potentially exposing confidential client details, case strategies, financial records, and personal identifiable information that are protected by attorney-client privilege regulations. The impact is severe for legal firms relying on this software, as it compromises not only individual privacy but also the firm's reputation and compliance with standards such as GDPR or HIPAA if applicable data types are exposed.
This vulnerability aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts, where adversaries use legitimate credentials to access resources they should not have permission to view. It also relates to CWE-284, Improper Access Control, as the system does not enforce proper restrictions on authenticated users regarding resource-specific permissions. The operational impact includes potential data breaches that could lead to legal liability, regulatory fines, and loss of client trust. Attackers can automate this process using scripts to iterate through a range of PFID values, effectively scraping large volumes of sensitive data with minimal effort once initial access is gained.
Mitigation strategies must focus on implementing robust authorization checks at the application layer. Developers should replace direct object references with indirect reference maps or ensure that every request involving resource retrieval includes explicit permission verification against the user's role and ownership attributes. It is essential to validate that the authenticated user owns the requested PFID before serving any data, rather than trusting the input parameter alone. Additionally, implementing rate limiting on login endpoints can help mitigate brute-force attempts used to discover valid IDs. Regular security code reviews focusing on access control logic and automated static analysis testing for IDOR patterns are recommended to prevent similar vulnerabilities in future releases of ProPhoenix Law RMS.