CVE-2026-27553 in ICE2-8IOL1-G65L-V1D
Summary
by MITRE • 09/16/2026
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described involves an insecure direct object reference or improper access control flaw within the diagnostic functionality of a web application, specifically targeting the ajax_diag_table_rows endpoint located at /index.php/diagnostics_tab/ajax_diag_table_rows. This issue arises because the system fails to adequately validate or sanitize the schema path parameter provided by the client during AJAX requests. Although authentication is required via a valid user cookie, the authorization logic does not restrict access based on privilege levels for this specific diagnostic operation. Consequently, an attacker with low-privileged remote access can exploit this misconfiguration to manipulate internal file paths or database query parameters that are intended only for administrative functions. The core technical flaw lies in the lack of strict input validation and insufficient separation of duties between standard user roles and system administrators regarding sensitive data retrieval operations.
From a security architecture perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-611 Improper Restriction of XML External Entity Reference if the schema path influences XML parsing, or more broadly CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The attacker leverages their authenticated session to send crafted requests where the schema parameter points to sensitive system files or database tables containing password hashes. By manipulating this parameter, the application inadvertently exposes internal structures that should remain isolated from regular user contexts. This represents a classic case of broken access control where the application trusts client-supplied input for critical path resolution without verifying if the requesting entity has the necessary permissions to perform such an action.
The operational impact of this vulnerability is severe as it leads to the disclosure of all user password hashes stored within the system's database or configuration files. Password hashes are sensitive cryptographic material that, while not immediately revealing plaintext passwords, significantly facilitate offline brute-force attacks and credential cracking attempts. If weak hashing algorithms like MD5 or SHA1 were used historically, or if salts are predictable or absent, attackers can rapidly recover user credentials. This compromise undermines the confidentiality integrity of the entire authentication system, potentially allowing lateral movement within the network once valid accounts are compromised. The exposure affects all users regardless of their privilege level since the endpoint does not filter requests based on role-based access control policies effectively.
To mitigate this vulnerability, developers must implement strict input validation for the schema path parameter, ensuring it only accepts predefined, safe values rather than arbitrary file paths or database identifiers. Implementing robust authorization checks is critical; the application should verify that the authenticated user possesses administrative privileges before allowing execution of diagnostic queries that access sensitive data structures. Additionally, applying principle of least privilege ensures that low-privileged users cannot invoke endpoints designed for system maintenance or debugging. Logging and monitoring these requests can also aid in detecting exploitation attempts. Regular security audits focusing on API endpoint permissions and parameter handling will help prevent similar issues where internal implementation details are exposed through improperly secured interfaces.