{"id":"CVE-2024-34323","published":"2026-10-13T16:17:08.210","lastModified":"2026-10-16T19:56:15.773","description":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://prophoenix.com/law-rms/","tags":[]},{"url":"https://sedriclouissaint.com/blog/prophoenix-law-rms-authentication-bypass-cve-2024-34323/#cve-details","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An insecure direct object reference vulnerability in ProPhoenix Law RMS allows attackers to access sensitive user data by manipulating the usrLogin$hdnPFID parameter in HTTP requests. This means unauthorized users can potentially view confidential information belonging to other users without proper authentication.","exploitability":"The vulnerability is highly exploitable with no prerequisites, as attackers only need to craft a simple HTTP request with a modified PFID value to access other users' sensitive information.","blast_radius":"If exploited, this IDOR could allow attackers to access personal and case-related data for multiple users, potentially exposing sensitive legal information across the entire system.","remediation":"Apply the vendor patch for ProPhoenix Law RMS version 2022.2403.3.101 or later, as this specific version contains the fix for the IDOR vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["idor","web","data-exfiltration","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:44:19.201Z"}}