| शीर्षक | ООО НПО "Ритм" GEOritm 2.45.1 Missing Authentication |
|---|
| विवरण | A vulnerability in the POST /restapi/objects/obj-groups method of the GEO.RITM software REST API is related to a lack of authentication before executing the function. Exploitation of this vulnerability could allow an attacker acting remotely without authentication, by passing an object identifier (objectId), to obtain the organizational and regional association of the object (division, region, operational status), and in some cases, the personal data of the responsible person (driver's last name and initials). When combined with the object enumeration method, this vulnerability allows for anonymous deanonymization of the entire fleet of monitored objects. .sh PoC below |
|---|
| स्रोत | ⚠️ https://pastebin.com/3VsEG3Rg |
|---|
| उपयोगकर्ता | Xanik (UID 100451) |
|---|
| सबमिशन | 08/08/2026 08:54 PM (2 महीनों पहले) |
|---|
| संयम | 27/09/2026 11:00 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 410853 [ООО НПО Ритм GEOritm तक 2.45.1 REST API obj-groups objectId कमजोर प्रमाणीकरण] |
|---|
| अंक | 17 |
|---|