{"uuid": "c043e85b-b343-4350-9a0c-fd7e16eb2951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26598", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/47295", "content": "Exploit Collector\nImpressCMS 1.4.2 Incorrect Access Control\n\nhttps://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png \nImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.\n\nMD5 | 3eef0d54701c87520c4c7a944b7f47a5\n\nDownload\n--------------------------------------------------------------------------\nImpressCMS <=\n--------------------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.2 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /include/findusers.php script:\n\n16.    include \"../mainfile.php\";\n17.    xoops_header(false);\n18.\n19.    $denied = true;\n20.    if (!empty($_REQUEST['token'])) {\n21.        if (icms::$security->validateToken($_REQUEST['token'], false)) {\n22.            $denied = false;\n23.        }\n24.    } elseif (is_object(icms::$user) && icms::$user->isAdmin()) {\n25.        $denied = false;\n26.    }\n27.    if ($denied) {\n28.        icms_core_Message::error(_NOPERM);\n29.        exit();\n30.    }        }\n\nThis script should be accessible to authenticated users only. However, \nbecause of the \"if\" statement at lines 20-23, this script could be \naccessed by unauthenticated attackers if they will provide a valid \nsecurity token. Such a token will be generated in several places within \nthe application, and some of them do not require the user to be \nauthenticated, like in the misc.php script. This might be exploited to \naccess an otherwise restricted functionality of the application, which \nin turn might allow an information disclosure about the CMS users.\n[-] Solution:\n\nUpgrade to version 1.4.3 or later.\n[-] Disclosure Timeline:\n\n[19/01/2021] - Vendor notified through HackerOne\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26598 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081137\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-03\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T01:00:34.496804Z"}