UNIT4TETA TETA WEB version 22.62.3.4 suffers from an authorization bypass vulnerability.
fdd28477bf2f54627c01a32c396aeec05fd01c67d3b979bdbca2491f59e2b4f0
Title: UNIT4TETA TETA WEB - Authorization Bypass vulnerability
Author: Lukasz MiedziĆski
Date: 08. January 2015
CVE: CVE-2015-1173
Affected software :
===================
UNIT4TETA TETA WEB 22.62.3.4 - newest version
Older versions are probably affected too.
Exploit was tested on :
======================
UNIT4TETA TETA WEB 22.62.3.4 - newest version
Description :
=============
TETA Web (former TETA Galactica) is an Internet platform interoperating
with TETA HR (former TETA Personnel) application. It provides support for
the HR departments of small, medium and very large companies.
With this platform managers obtain a tool for effective management of
subordinate business units, and HR departments can transfer some of their
tasks, such as generating reports and printouts, monitoring leave days
numbers and periodic examination dates, to employees and their supervisors.
Vulnerabilities :
*****************
Authorization Bypass :
================================
Description: Unauthorized users are able to manipulate received parameters
and get privileges to modules:
- Design Mode
- Debug Logger mode
Vulnerability is confirmed by Vendor. Patch is released
Contact :
=========
Lukasz[dot]Miedzinski[at]gmail[dot]com