| शीर्षक | pihome-shc PiHome HVAC 2.0 Missing Authorization |
|---|
| विवरण | A missing authorization vulnerability (CWE-862) was discovered in PiHome HVAC v2.0, specifically in the /user_accounts.php endpoint. The application does not verify whether the user initiating an account creation request has administrative privileges, allowing any authenticated user to create new admin accounts. This flaw can lead to full system compromise if exploited. Proper authorization checks and role-based access control (RBAC) are recommended to mitigate this issue. |
|---|
| स्रोत | ⚠️ https://www.singto.io/pocsforexploits/pihomehvac-improper-access-control.md |
|---|
| उपयोगकर्ता | Jelle Janssens (UID 81048) |
|---|
| सबमिशन | 10/02/2025 01:54 PM (2 साल पहले) |
|---|
| संयम | 10/02/2025 11:45 PM (10 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 295173 [pihome-shc PiHome 2.0 Role-Based Access Control /user_accounts.php?uid अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|