An insecure direct object reference vulnerability in SIMAC MyPHR 1.1 allows authenticated attackers to perform full account takeovers and access sensitive employee data.

This vulnerability is an insecure direct object reference (CWE-639) located in multiple API endpoints, including those responsible for employee profile management and payroll document retrieval. It allows any authenticated user to bypass ownership validation and modify arbitrary employee accounts, including password resets, by supplying manipulated identifiers in PUT requests.

This flaw carries a CVSS score of 8.8, reflecting its high impact on data confidentiality, integrity, and availability. Successful exploitation enables unauthorized access to personally identifiable information and financial pay bulletins, while the ability to reset passwords facilitates full account takeover. Such compromises pose significant risks of data breach, regulatory non-compliance, and severe reputational damage to the organization.

Immediate Action: Contact SIMAC support to obtain the necessary security update for version 1.1, as a formal patch is currently not publicly confirmed.

Proactive Monitoring: Review web server and API access logs for suspicious patterns, such as sequences of PUT requests targeting multiple sequential employee identifiers or unauthorized access to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to intercept and block API requests that exhibit IDOR patterns, specifically those attempting to access or modify resources outside the scope of the authenticated user session.

Public Exploit Available: Yes, a technical write-up containing a functional proof-of-concept and cURL commands for account takeover was published on GitHub.

Given the severity of the potential account takeover and the exposure of sensitive employee data, this vulnerability must be treated with high priority. Organizations using SIMAC MyPHR 1.1 should restrict access to the affected API endpoints until a vendor-supplied patch is successfully applied and verified.