CVE-2021-37214

The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command.

The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command.

La página de gestión de empleados de Flygo contiene una vulnerabilidad de tipo Insecure Direct Object Reference (IDOR). Después de ser autenticado como un usuario general, unos atacantes remotos pueden manipular el ID del empleado en parámetros específicos para acceder arbitrariamente a los datos del empleado, modificarlos, y luego obtener el privilegio de administrador y ejecutar un comando arbitrario