Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2024-34323: ProPhoenix Law RMS lets attackers view other users’ data
CVE-2024-34323 · published today
Summary
The 2022.2403.3.101 version of ProPhoenix Law RMS does not properly verify who is requesting information, so someone could send a specially crafted web request and see private data belonging to other users. This could expose client details, case files, or internal records. Apply the vendor’s security update or patch and review access controls to ensure only authorized users can retrieve data.
Original advisory text
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive ...
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
Severity
10.0
Critical
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
CVE-2024-34323 · NVD
Track software like this
Free during beta