| शीर्षक | Omega Solution CoinEx Crypto latest Authorization Bypass |
|---|
| विवरण | Omega Solution CoinEx Crypto 2025 contains an Insecure Direct Object Reference (IDOR) vulnerability in the customer profile update functionality. The application fails to enforce object-level authorization when processing profile update requests and directly trusts a user-controlled customer identifier to determine the target resource. An authenticated customer can manipulate the customer identifier in the request path to update profile information belonging to another customer without authorization. Successful exploitation results in unauthorized modification of customer account data, including profile information such as name, email address, telephone number, and other editable fields, leading to horizontal privilege escalation and compromise of data integrity.
Affected Component:
Customer Profile API
Affected Endpoint:
POST /customer/{id} (_method=PUT)
Affected Parameter:
{id}
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control
OWASP API Security Top 10: API1 – Broken Object Level Authorization |
|---|
| स्रोत | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/24 |
|---|
| उपयोगकर्ता | 4m3rr0r (UID 85795) |
|---|
| सबमिशन | 17/07/2026 07:49 PM (3 महीनों पहले) |
|---|
| संयम | 03/10/2026 11:43 AM (3 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413345 [Omega Solution CoinEx Crypto 2025 Customer Profile API /customer/ id अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|