Indifyify v3.1.1 Unbound PSID/REID Data Leakage Vulnerability and PoC

Vulnerability Summary: Unauthorized PSID/REID Data Read in ideqlify v3.1.1 Vulnerability Overview Vulnerability Name: Unauthorized Read of PSID/REID Data in ideqlify v3.1.1 Vulnerability Type: Unauthorized Access (Information Disclosure) Affected Component: ideqlify plugin v3.1.1 and earlier versions Vulnerability Description: - Attackers can craft specific requests to bypass authentication checks and directly read sensitive data stored in the database, such as PSID (Product SKU ID) and REID (Request ID). - The vulnerability exists in the plugin's endpoint, which fails to adequately validate request parameters. - This can lead to the exposure of sensitive business data, including product inventory, pricing, and user order information. Scope of Impact Affected Versions: ideqlify v3.1.1 and all earlier versions Affected Platform: WordPress websites (with the ideqlify plugin installed) Exploitation Conditions: - No login or authentication required - Only requires knowledge of the target site URL and plugin path - Remotely exploitable Remediation Official Patched Version: ideqlify v3.1.2 and later Temporary Mitigation Measures: - Disable the ideqlify plugin (if not essential) - Use firewall rules to restrict access to the path - Implement access controls at the server level (e.g., via Nginx/Apache configuration) POC Code (Full Extraction) > ⚠️ Note: This code is intended solely for authorized testing environments. Do not use for illegal purposes. Additional Information CVE ID: Not yet assigned (pending) Disclosure Date: 2024-06-15 Report Source: Security Researcher @SecResearcher Remediation Recommendation: Immediately upgrade to the latest version and review historical logs for any signs of abnormal access. --- ✅ It is strongly recommended that all WordPress site administrators using the ideqlify plugin update the plugin promptly and audit related API endpoint calls.

Goal Reached Thanks to every supporter — we hit 100%!

Indifyify v3.1.1 Unbound PSID/REID Data Leakage Vulnerability and PoC