Remote User Enumeration in Web Application

Executive Summary

This vulnerability allows a low-privileged remote attacker to list all configured users and determine which accounts have elevated privileges by accessing the /api/user/fetch-all.php endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the endpoint /api/user/fetch-all.php is accessible without authentication. Use tools like curl to send a GET request to the endpoint and observe if user data is returned. Example command: curl -v http://<target-ip>/api/user/fetch-all.php

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this information to target privileged accounts for further attacks, such as privilege escalation or unauthorized access to sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows enumeration of user accounts and identification of elevated privileges, which could lead to unauthorized access to sensitive data. For GDPR, this may violate principles of data protection and user rights. For HIPAA, it risks exposing protected health information if user roles are compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /api/user/fetch-all.php endpoint to authorized users only. Update server configurations to enforce authentication and authorization checks. Monitor logs for repeated access attempts to this endpoint.

Useful 0 Not Useful 0