Exploitation Summary
EIP tracks 1 public exploit for CVE-2021-46416. PoCs published by Momen Eldawakhly.
AI-analyzed exploit summary This exploit demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in SAM SUNNY TRIPOWER 5.0 by manipulating the 'username' field in the cookie to access another user's session. The PoC shows how changing the 'username' value from 861 to 850 allows unauthorized access to another user's data.
Description
Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
Exploits (1)
This exploit demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in SAM SUNNY TRIPOWER 5.0 by manipulating the 'username' field in the cookie to access another user's session. The PoC shows how changing the 'username' value from 861 to 850 allows unauthorized access to another user's data.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N