| tiêu đề | Intelliants Subrion CMS 4.2.1 Information Disclosure |
|---|
| Mô tả | An unauthenticated information disclosure vulnerability was identified in Intelliants Subrion CMS 4.2.1 in the assign-owner action implemented by front/actions.php. The public JSON endpoint /actions.json?action=assign-owner&q= does not perform an authentication or authorization check before querying active members. It returns the numeric member ID and a fullname value containing the member's full name and email address. The q parameter is appended directly to a SQL LIKE prefix. Because LIKE wildcard characters are not escaped, the value q=% (URL encoded as %25) produces the pattern %% and returns up to 20 active accounts. No authentication cookie is required.
Proof of Concept request:
GET /actions.json?action=assign-owner&q=%25 HTTP/1.1
Host: TARGET
Accept: application/json
Connection: close
Observed response from a clean local installation:
HTTP/1.1 200 OK
Content-Type: application/json
[{"id":"1","fullname":"Administrator ([email protected])"}]
Affected component: front/actions.php, lines 207-226 in tag v4.2.1.
Affected parameter: q.
Attack requirements: network access only; no privileges and no user interaction.
Impact: disclosure of active member IDs, full names, and email addresses. The data can facilitate targeted phishing, credential stuffing, username discovery, and social engineering against administrators and members.
Suggested CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and CWE-862 Missing Authorization.
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3).
Recommendation: require an authenticated user with explicit owner-assignment permission, remove email addresses from responses unless strictly necessary, escape SQL LIKE wildcards, and rate-limit account searches.
Source: https://github.com/intelliants/subrion/blob/v4.2.1/front/actions.php#L207-L226
Product: https://github.com/intelliants/subrion
Vendor notification: https://github.com/intelliants/subrion/issues/916
Full public advisory and PoC: https://github.com/volksec/SubrionCMS-Security-Advisories/issues/1
The issue was reproduced only against a clean local installation. No public Subrion infrastructure was tested. The vendor was contacted before this CVE request. No CVE is known to be assigned and the issue has not been submitted to another CNA. |
|---|
| Nguồn | ⚠️ https://github.com/volksec/SubrionCMS-Security-Advisories/issues/1 |
|---|
| Người dùng | volksec (UID 93050) |
|---|
| Đệ trình | 25/07/2026 04:26 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 23/09/2026 18:11 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 409027 [Intelliants Subrion CMS đến 4.2.1 actions.json?action=assign-owner q tiết lộ thông tin] |
|---|
| điểm | 20 |
|---|