CVE-2024-56902

The exploit demonstrates an information disclosure vulnerability in GeoVision GV-ASManager (v6.1.0.0 or less) by sending a crafted POST request to retrieve all user accounts and their cleartext passwords. It requires low-privilege access (e.g., Guest account) and leverages the 'UA_GetAllUserAccount' action in the ASWebCommon.srf endpoint.

This repository documents CVE-2024-56902, an information disclosure vulnerability in Geovision GV-ASManager v6.1.0.0 or earlier, allowing low-privilege accounts to retrieve cleartext passwords of any user. The writeup includes steps to exploit the vulnerability and its impact.