Skip to content
Threat Feed
Subscribe

Tag

Dns-Takeover

1 brief RSS
medium advisory

Poweradmin: Broken Access Control (IDOR) Allows DNS Record Modification

A low-privilege authenticated user in Poweradmin (a web front-end for PowerDNS) can exploit an Insecure Direct Object Reference (IDOR) vulnerability, allowing them to modify any DNS record on the server, even those they do not own, by manipulating POST request parameters to bypass access control checks and achieve DNS record repointing, disabling, or hijacking, leading to data integrity and availability issues, and potentially cross-tenant DNS takeover.

Poweradmin +2 idor dns-takeover web-application vulnerability access-control
3t 5i