| 제목 | TOTVS Food Service - BAC + IDOR leads to unauthorized access to sms messages from other companies. |
|---|
| 설명 | "TOTVS Food Service, Standard plan, is ideal for bars, restaurants, cafeterias and other companies in the food segment, which value the quality of service and excellence in the financial management of the establishment."
The TOTVS Food Service - Standard product has a BAC + IDOR vulnerability on the endpoint:
/message/form/<Base64 number 1-750>
By changing this ID, we were able to edit the order status sms message for other restaurants/bars other than ours.
To reproduce this vulnerability, it is necessary to have a low-privilege account on a host that uses the TOTVS Food product.
The vulnerability affects all TOTVs customers who use this product.
/message/form/NzQx (base64 decode=741)
/message/form/MQ== (base64 decode=1)
/message/form/NTI4
Video Link PoC:
https://www.youtube.com/watch?v=yjc92hb6T8s
Credentials for test and url:
https://totvsfood.ninegrid.com.br/
Login: [email protected]
Password: ninegrid123 |
|---|
| 원천 | ⚠️ https://totvs.store/br/produto/totvs-food-service-standard.html |
|---|
| 사용자 | Stux (UID 40142) |
|---|
| 제출 | 2023. 04. 30. AM 06:08 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 04. 30. AM 07:52 (2 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 227759 [TOTVS Food Service Order Status /message/form/ 권한 상승] |
|---|
| 포인트들 | 20 |
|---|