← Advisories

UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation Through Authorization Bypass

High
Advisory ID
ZSL-2020-5575
Release Date
19 July 2020
Vendor
UBICOD Co., Ltd., MEDIVISION INC. - http://www.medivision.co.kr
Affected Version
Firmware 1.5.1 (2013.01.3)
CVE
N/A
Tested On
Apache/2.4.7 (Ubuntu), PHP/5.5.9-1ubuntu4.22
Summary

Medivision is a service that provides everything from DID operation to development of DID (Digital Information Display) optimized for hospital environment and production of professional contents, through DID product installation, image, video content planning, design work, and remote control. This is a one-stop solution that solves management at once.

Description

The application suffers from a privilege escalation vulnerability. Normal user can elevate his/her privileges by navigating to /html/user (via IDOR) page sending an HTTP GET request setting the parameter 'ft[grp]' to integer value '3' gaining super admin rights.

Proof of Concept
Disclosure Timeline
19.06.2020Vulnerability discovered.
21.06.2020Vendor contacted.
18.07.2020No response from the vendor.
19.07.2020Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
19.07.2020Initial release
24.07.2020Added reference [1], [2] and [3]