CVE-2025-1270 — Insecure direct object reference (IDOR) vulnerability in H6Web

Description (CNA)

Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint to refer to another user. In addition, the first request could also allow the attacker to impersonate other users. As a result, all requests made after exploitation of the IDOR vulnerability will be executed with the privileges of the impersonated user.

Affected (CNA)

Vendor / product	Versions
Anapi Group / H6Web	affected all versions

CWE

CWE-639

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-anapi-group-h6web

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.