CVE-2024-34324
UnknownSummary
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.
Risk Assessment
An attacker can hijack an active user session, gaining unauthorized access to the system and its data.
Recommendation
Update ProPhoenix Law RMS to a patched version or contact the vendor for a fix; consider implementing additional session protection mechanisms.
Other vulnerabilities in ProPhoenix Law RMS
See all- CVE-2024-34326Unknown
The vulnerability in ProPhoenix Law RMS version v2022.2403.3.101 is a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.
- CVE-2024-34321Unknown
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.
- CVE-2024-34320Unknown
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
- CVE-2024-34319Unknown
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.
- CVE-2024-34323Critical
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
Original NVD description (English source)
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS