High · published November 4, 2025
⚡ A single POST request is all it takes to access sensitive user info! This lack of authorization in CanalDenuncia.app could let attackers poke around where they shouldn’t. 😱 Think of it like a restaurant where anyone can walk into the kitchen just by changing their order number—no checks, no questions! This flaw allows unauthorized users to dig through others' private comments without breaking a sweat. An attacker could exploit this vulnerability to sift through another user's comments, potentially revealing sensitive information and compromising privacy. It's like leaving the door to your personal diary wide open for anyone to read!
Think of it like a restaurant where anyone can walk into the kitchen just by changing their order number—no checks, no questions! This flaw allows unauthorized users to dig through others' private comments without breaking a sweat. This vulnerability in CanalDenuncia.app arises from a missing authorization check when accessing the endpoint '/backend/api/buscarComentariosByDenuncia.php'. By manipulating the 'id_denuncia' parameter in a POST request, attackers can access data they shouldn't be able to see.
An attacker could exploit this vulnerability to sift through another user's comments, potentially revealing sensitive information and compromising privacy. It's like leaving the door to your personal diary wide open for anyone to read! Immediate action is needed! Patch CanalDenuncia.app with an update that includes proper authorization checks on the 'id_denuncia' parameter. Regularly audit your code to ensure all endpoints are adequately protected. 🛡️ You've got this! Tackle this vulnerability head-on, and you’ll keep your users' information safe. 🦸
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |