CVE-2024-34323 Details

A vulnerability allowing authentication bypass via Insecure Direct Object Reference (IDOR) has been identified in ProPhoenix Law Records Management Software (RMS) version 2022.2403.3.101. The issue arises from the login form's hidden parameter, 'usrLogin$hdnPFID', which carries the primary key of the user account. Instead of verifying credentials and binding the session to the authenticated user, the server accepts the ID from the parameter, allowing attackers to gain unauthorized access to another user's session. This exploitation grants full access to sensitive information and functionalities within the application, including case files, arrest records, and the ability to manipulate evidence and reports, all under the impersonated officer's name.

The vulnerability has been fixed in ProPhoenix Law RMS version 2024.2403.3.101. Users should update to this version and verify that the application no longer accepts 'usrLogin$hdnPFID' as a valid authentication parameter.