CVE-2024-46097

EIP tracks 1 public exploit for CVE-2024-46097. PoCs published by Alkatraz97.

AI-analyzed exploit summary The repository contains detailed technical writeups for multiple CVEs, including CVE-2024-46097, which describes an incorrect access control vulnerability in TestLink Open Source Test Management. The writeup includes step-by-step reproduction steps, screenshots, and technical details about how low-privileged users can modify high-privilege resources due to incremental IDs and lack of proper access controls.

TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.