| शीर्षक | Industrial Application Software - IAS Canias ERP 8.03-- Observable Response Discrepancy (CWE-204) |
|---|
| विवरण | A vulnerability has been found in Industrial Application Software caniasERP 8.03 and classified as medium. The affected function is doAction of the component Login RMI Interface (default TCP port 27499). The manipulation leads to information disclosure through observable response discrepancy (CWE-204). The attack can be launched remotely without authentication. The server returns distinct status codes for non-existent usernames (USERNOTFOUND, code 1) versus incorrect passwords (USERWRONGPASSWORD, code 2), enabling systematic enumeration of all valid user accounts. The iasLoginResponseStatus enum defines 35 distinct codes, allowing an attacker to determine with certainty whether a given username exists without knowing any valid password.
Discovered by Bilal Güneş (@b1lal) of HawkTrace. |
|---|
| स्रोत | ⚠️ https://gist.github.com/0xb1lal/85422a63c10a001c75a22365457de624 |
|---|
| उपयोगकर्ता | b1lal (UID 97312) |
|---|
| सबमिशन | 20/04/2026 06:07 PM (6 महीनों पहले) |
|---|
| संयम | 09/05/2026 06:33 PM (19 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 362458 [Industrial Application Software IAS Canias ERP 8.03 Login RMI Interface doAction सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|