redteambrasil/cve-2020-24028PoC for CVE-2020-24028: privilege escalation via authenticated permission bypass in ForLogic Qualiex, allowing user creation and password changes.
ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates.
Insecure Permissions
ForLogic
Qualiex
Remote
True
True
Authenticated permission bypass permits password changes, user creation and privilege escalation on user's information update
True
Mauricio Santos (R&D UnderProtection), Claudemir Nunes (R&D UnderProtection) and Hesron Hori (R&D UnderProtection) and @redteambrasil
Forlogic - Vendor's Information Security Team who collaborated to a coordinated disclosure
