A critical authentication bypass vulnerability in Elektraweb EasyPMS 1.0.0 allows unprivileged attackers to escalate privileges to administrative levels and compromise user accounts.

This vulnerability involves improper input validation where an authenticated low-privileged user can manipulate SQL queries within JSON requests. By injecting characters into ID parameters, an attacker can bypass authorization checks to access administrative account information and subsequently reset passwords without valid token authentication.

The ability to reset administrative passwords enables unauthorized individuals to gain full control over the hotel management system. This leads to severe risks, including unauthorized data access, potential exfiltration of sensitive guest information, and complete system compromise. Given the CVSS score of 7.5, this high-severity flaw poses a significant threat to operational integrity and data privacy.

Immediate Action: Update to the latest version of EasyPMS provided by Elektraweb, which includes the necessary input validation fixes to prevent SQL manipulation.

Proactive Monitoring: Review system access logs for anomalous POST requests to the /Select/STDUSER or root endpoints, particularly those containing unexpected special characters in ID fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts and unauthorized attempts to access user profile modification endpoints.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID 48858).

The severity of this authentication bypass necessitates immediate action to prevent unauthorized administrative access. Administrators must ensure all instances of EasyPMS 1.0.0 are updated to the vendor-patched version to eliminate this vector for privilege escalation. Failure to patch leaves the system vulnerable to trivial account takeover by low-privileged users.