Achievo Time Registration Module 'dispatch.php' Security Bypass Vulnerability

Bugtraq ID:	43544
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 27 2010 12:00AM
Updated:	Sep 27 2010 12:00AM
Credit:	Pablo G. Milano from CYBSEC S.A. Security Systems
Vulnerable:	Achievo Achievo 1.4.3 Achievo Achievo 1.4.2 Achievo Achievo 1.4 Achievo Achievo 1.3.4 Achievo Achievo 1.3.2 Achievo Achievo 1.2.1 Achievo Achievo 1.1 Achievo Achievo 1.2
Not Vulnerable:	Achievo Achievo 1.4.5

Achievo Time Registration Module 'dispatch.php' Security Bypass Vulnerability

Achievo is prone to a security-bypass vulnerability because it fails to properly validate access requests within the Time Registration module.

An attacker can exploit this issue to bypass security restrictions to add or delete the hours of another user.

Versions prior to Achievo 1.4.5 are vulnerable.

Achievo Time Registration Module 'dispatch.php' Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Achievo Time Registration Module 'dispatch.php' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Achievo Time Registration Module 'dispatch.php' Security Bypass Vulnerability

References:

• Achievo 1.4.5 - Security Bugfix release (Achievo)
  
• Achievo Homepage (Achievo)
  
• CYBSEC Advisory 2010 0901 Achievo 1.4.3 (Multiple Authorization Flaws) ("CYBSEC Labs" )