| 제목 | Eleveo Quality Management 9.7.0 Log Poisoning |
|---|
| 설명 | An Insecure Design vulnerability exists in the UtilsService.createAndSaveAudit GWT RPC method of Eleveo Quality Management 9.7.0, allowing authenticated users to manipulate audit log entries. Users can submit arbitrary messages and categories, flood the audit logs with repeated entries, or bypass logging entirely by dropping the request. The backend relies on client-supplied requests to create audit log entries instead of performing logging internally, allowing authenticated users to manipulate, bypass, or flood the audit trail.
Impact
• Poisoning of audit logs, allowing malicious or misleading entries to be inserted.
• Denial of accountability, as actions can be performed without creating corresponding audit entries.
• Flooding of audit logs, potentially degrading system performance or obscuring legitimate events.
PoC
Comprehensive reproduction steps, including supporting screenshots, are available via the shared private link. Public disclosure will occur on GitHub after the responsible disclosure period of approximately 90 days has elapsed.
Note
Contact with the vendor was initiated on April 5, and no response has been received as of the submission date. The provided PoC is accessible via a restricted link and is intended solely for review purposes by anyone possessing the link. I plan to reserve a CVE early, with public disclosure scheduled after 90 days from the initial contact date, at which point the advisory will be published on my GitHub repository. The information shared here is provided exclusively to the VulnDB team to ensure awareness and understanding of the vulnerability details.
Vendor: https://www.eleveo.com/
Software: https://help.eleveo.com/qms/9.7/user/quality-management-guide |
|---|
| 원천 | ⚠️ https://drive.google.com/file/d/18fGYUBefbMreujzivIfFpPE8kWDLQCCU/view?usp=sharing |
|---|
| 사용자 | omarelshopky (UID 85487) |
|---|
| 제출 | 2026. 07. 18. PM 03:10 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 28. AM 10:12 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 410998 [Eleveo Quality Management 9.7.0 GWT RPC QMUtilsService UtilsService.createAndSaveAudit 정보 공개] |
|---|
| 포인트들 | 20 |
|---|