CVE-2025-52389 PoC — Envasadora H2O Soda Cristal 安全漏洞

Source

Associated Vulnerability

Description

An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows unauthenticated attackers to access sensitive data for other users via a crafted HTTP request.

Readme

# CVE-2025-52389
# Description
An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows unauthenticated attackers to access sensitive data for other users via a crafted HTTP request.
# Version
app.sodacristal - 40.20.4
## Proof of Concept
When accessing the customer's contract at https://www.app.sodacristal.com/contrato/#contract_number# you can change the number so you can see another customer's contract.
To make the filter easier you can use burp suite and filter by site length.

File Snapshot

 [4.0K]  /data/pocs/d16b0f73b5351e78dee02afd6aad0f093fcf8a51
└── [ 529]  README.md

0 directories, 1 file

Remarks