Skip to content
Threat Feed
Subscribe

Vendor

Poweradmin

3 briefs RSS
high advisory

Poweradmin OIDC `sub` Collation Bypass Leads to Account Takeover

A collation vulnerability in Poweradmin's OIDC integration allows an unauthenticated attacker to take over victim accounts by exploiting the case and accent-insensitive MySQL collation (`utf8mb4_unicode_ci`) used for OIDC subject (`sub`) identifiers, causing the attacker's colliding `sub` to resolve to the victim's `user_id` during authentication.

Poweradmin >= 4.1.0, < 4.2.5 +1 account-takeover oidc vulnerability web-application poweradmin
1t
high advisory

Poweradmin API Privilege Escalation via User-Update Endpoint

A vulnerability in Poweradmin's REST API user-update endpoint allows a non-admin user with 'user_edit_others' permission to reset any user's password, including superusers, leading to full administrative account takeover by exploiting inconsistent authorization rules between the API and web UI.

Poweradmin +1 privilege-escalation web-application api-vulnerability account-takeover
1r 2t
medium advisory

Poweradmin: Broken Access Control (IDOR) Allows DNS Record Modification

A low-privilege authenticated user in Poweradmin (a web front-end for PowerDNS) can exploit an Insecure Direct Object Reference (IDOR) vulnerability, allowing them to modify any DNS record on the server, even those they do not own, by manipulating POST request parameters to bypass access control checks and achieve DNS record repointing, disabling, or hijacking, leading to data integrity and availability issues, and potentially cross-tenant DNS takeover.

Poweradmin +2 idor dns-takeover web-application vulnerability access-control
3t 5i