{"uuid": "084a201a-2a47-46f6-9417-cb93a3208f54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41382", "type": "seen", "source": "https://t.me/hacking_Attack/28108", "content": "Exploit Collector\nPlastic SCM 10.0.16.5622 Insecure Direct Object Reference\n\nhttps://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png \nPlastic SCM version 10.0.16.5622 suffers from an insecure direct object reference vulnerability that lets an attacker set the administrative password.\n\nMD5 | f088be0f3c4ca9a1c3c79ded1aca8335\n\nDownload\n# Exploit Title: Plastic SCM 10.0.16.5622 - WebAdmin Server Access\n# Shodan Dork: title:\"Plastic SCM\"\n# Date: 18.10.2021\n# Exploit Author: Basavaraj Banakar\n# Vendor Homepage: https://www.plasticscm.com/\n# Software Link: https://www.plasticscm.com/download/releasenotes/10.0.16.5622\n# Version: Plastic SCM < 10.0.16.5622\n# Tested on: Chrome,Firefox,Edge\n# CVE : CVE-2021-41382\n\n# Reference: https://infosecwriteups.com/story-of-google-hall-of-fame-and-private-program-bounty-worth-53559a95c468\n\n# Exploit:\n\n1. Navigate to target.com/account [This holds administrator login console]\n\n2. Change URL to target.com/account/register [Here able to set new password for the adminstrator user]\n\n3. Now after changing password of administrator and login to console and Navigate to target.com/configuration/authentication and set an new password for any of the users\n\n4. Now navigate to target.com/webui/repos and login with the recently changed password for user i.e is in step 3\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.004024Z"}