High · published November 4, 2025
⚡ A crafty POST request could expose private user data on CanalDenuncia.app! An attacker can retrieve sensitive information using just a couple of parameters. 🔍 Think of it like a restaurant where anyone can sneak into the back kitchen and peek at customer orders—no one checks who you are or what you're doing back there! An attacker could easily access other users' information, potentially leading to identity theft, privacy violations, and a loss of trust in the application. Imagine the chaos when sensitive data is no longer safe!
Think of it like a restaurant where anyone can sneak into the back kitchen and peek at customer orders—no one checks who you are or what you're doing back there! This vulnerability stems from a lack of proper authorization checks in the API endpoint '/backend/api/buscarTestigoByIdDenunciaUsuario.php', allowing unauthorized users to access personal information simply by manipulating the 'id_denuncia' and 'id_user' parameters.
An attacker could easily access other users' information, potentially leading to identity theft, privacy violations, and a loss of trust in the application. Imagine the chaos when sensitive data is no longer safe! To fix this, implement strict authorization checks on the API endpoint to ensure that only authorized users can access the data. Make sure to review and update your access controls promptly! You've got this! With the right steps, you can secure CanalDenuncia.app and protect user data like a superhero! 🦸
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |