CVEvulnerability
CVE-2018-16606
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-09-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-639
Description
In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and their authors' personal information (Name, Email, Organization, and Position) by changing the value of Paper ID (the pid parameter).
Affected configurations
• proconf proconf (< 6.1)
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://blog.ziaurrashid.com/idor-on-proconf-peer-reviewand-conference-management-system/ Exploit, Third Party Advisory
- https://packetstormsecurity.com/files/149259/IDOR-On-ProConf-Peer-Review-And-Conference-Management-6.0-File-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- https://blog.ziaurrashid.com/idor-on-proconf-peer-reviewand-conference-management-system/ Exploit, Third Party Advisory
- https://packetstormsecurity.com/files/149259/IDOR-On-ProConf-Peer-Review-And-Conference-Management-6.0-File-Disclosure.html Exploit, Third Party Advisory, VDB Entry