IntelliChoice eFORCE Software Suite 2.5.9.6 HTTP POST Request ctl00$MainContent$UserName response discrepancy

Summaryinfo

A vulnerability identified as problematic has been detected in IntelliChoice eFORCE Software Suite 2.5.9.6. This vulnerability affects unknown code of the component HTTP POST Request Handler. Performing a manipulation of the argument ctl00$MainContent$UserName results in response discrepancy. This vulnerability is reported as CVE-2021-47717. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability classified as problematic has been found in IntelliChoice eFORCE Software Suite 2.5.9.6. This affects some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument ctl00$MainContent$UserName with an unknown input leads to a response discrepancy vulnerability. CWE is classifying the issue as CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. This is going to have an impact on confidentiality. The summary by CVE is:

IntelliChoice eFORCE Software Suite 2.5.9 contains a username enumeration vulnerability that allows attackers to enumerate valid users by exploiting the 'ctl00$MainContent$UserName' POST parameter. Attackers can send requests with valid usernames to retrieve user information.

The weakness was disclosed by Gjoko Krstic as 50164. It is possible to read the advisory at exploit-db.com. This vulnerability is uniquely identified as CVE-2021-47717 since 12/05/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (50164). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• IntelliChoice

Name

• eFORCE Software Suite

Version

• 2.5.9.6

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion