CVE-2024-55507

The vulnerability classified as CWE-281 (Improper Preservation of Permissions) affects the delete_e.php component, which improperly manages permissions during operations. A remote attacker can send a specially crafted request to this component, resulting in unauthorized acquisition of higher privileges in the application. The vulnerability does not require prior authentication or user interaction.

An attacker can obtain elevated privileges in the system, potentially allowing complete takeover of the application, reading, modifying, or deleting data managed by the system.

Patches available from the vendor should be applied according to references. Until the fix is implemented, it is recommended to restrict access to the delete_e.php component at the web server level (e.g., through a firewall or HTTP server rules) and monitor suspicious requests directed to this endpoint.

Codeastro Complaint Management System v.1.0