Incorrect Access Control in Feehi CMS 2.1.1

Executive Summary

Feehi CMS 2.1.1 has an Incorrect Access Control vulnerability. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account without providing the old password. This happens because the server does not enforce protection for the super administrator account during updates.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Feehi CMS version 2.1.1 is installed. Inspect the backend files for AdminUserController.php, AdminUserService.php, and AdminUser.php. Monitor POST requests to the admin-user/update endpoint for unauthorized password changes to the super administrator account.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker could exploit this to escalate privileges remotely. They could take full control of the CMS by changing the super administrator password, gaining access to all administrative functions and potentially sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Feehi CMS to a patched version if available. Restrict access to the admin-user/update endpoint and enforce old password verification. Remove unnecessary administrator-update permissions for low-privilege accounts.

Useful 0 Not Useful 0