The SOCA Access Control System is vulnerable to multiple insecure direct object reference flaws that allow unauthorized access to sensitive user credentials, posing a significant risk to physical and digital security.

The system suffers from insecure direct object reference (IDOR) vulnerabilities in the Get_Permissions_From_DB.php and Ac10_ReadSortCard endpoints. These flaws allow both authenticated and unauthenticated attackers to bypass authorization controls and extract sensitive information, including user password hashes and access PINs.

A successful exploit allows an attacker to obtain administrative or user credentials, which could lead to unauthorized physical access to facilities managed by the access control system. Given the CVSS score of 7.5, the vulnerability is classified as High severity, as it facilitates unauthorized data disclosure that directly compromises the integrity and security of the access control environment.

Immediate Action: As no official patch is currently available, restrict access to the web management interface by placing it behind a VPN or firewall, ensuring it is not exposed to the public internet.

Proactive Monitoring: Review web server and application access logs for suspicious requests directed at the Get_Permissions_From_DB.php and Ac10_ReadSortCard endpoints, particularly those originating from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or flag requests containing parameters that attempt to access these specific vulnerable PHP and CGI endpoints.

Public Exploit Available: Yes, a functional proof-of-concept exploit is available via ExploitDB (EDB-ID: 46832).

Due to the sensitive nature of the exposed credentials and the presence of a public exploit, this vulnerability must be treated with high urgency. Organizations utilizing the affected SOCA Access Control System versions should immediately isolate the management interface from untrusted networks and evaluate alternative security measures until a vendor-supplied update is released.