kalcaddle kodbox पासवर्ड-सुरक्षित शेयर auth.class.php में अनुचित प्रमाणीकरण

The improper authentication flaw in kodbox allows attackers to bypass authentication mechanisms. Successful exploitation could grant an attacker unauthorized access to the system, enabling them to view, modify, or delete sensitive data stored within the kodbox environment. Depending on the system's configuration and the data stored, this could lead to data breaches, system compromise, and potential disruption of services. The availability of a public exploit significantly increases the likelihood of exploitation, particularly if the vendor does not release a timely patch.

Organizations utilizing kodbox version 1.64–1.64, particularly those hosting the application on shared hosting environments or without robust access controls, are at significant risk. Systems with sensitive data stored within kodbox are especially vulnerable.

• php / server:

grep -r 'auth.class.php' /workspace/source-code/

• generic web:

curl -I https://your-kodbox-instance/workspace/source-code/app/controller/explorer/auth.class.php | grep -i '403 forbidden'

1. 2026-03-26Disclosure

   disclosure

1. आरक्षित2026-03-25
2. प्रकाशित2026-03-26
3. EPSS अद्यतन2026-04-02

Due to the lack of a provided fixed version, immediate mitigation is crucial. Restrict access to the /workspace/source-code/app/controller/explorer/auth.class.php file and related resources. Implement strict access controls and authentication policies to limit the potential impact of a successful attack. Monitor system logs for suspicious activity, particularly authentication failures or unusual access patterns. Consider using a web application firewall (WAF) to filter malicious requests targeting the vulnerable endpoint. Regularly review and update security configurations to minimize the attack surface.