Authentication Bypass Leading to Server-Side Command Execution
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The affected software is the frevvo public registration form (onPhase/), which lets unauthenticated remote attackers log in as other tenant users, gain administrator and designer privileges, and run arbitrary operating system commands on the server. Successful exploitation could result in full compromise of the server and the data and systems it controls.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
Affected versions
- onPhase onPhase Forms
11.0.14