ProPhoenix Law RMS: Authentication bypass via IDOR in login
Summary
ProPhoenix Law RMS v2022.2403.3.101, a browser-based records management system for police agencies, contains an Insecure Direct Object Reference in the hidden login field usrLogin$hdnPFID. A researcher reports that changing this value in a login request returns the session of another user, without a valid password. The attacker could then read and change case and arrest records and run database queries as that officer. The attack needs only network access to the login page and no prior account.
Affected
- ProPhoenix Law RMS v2022.2403.3.101 (per CVE record and researcher)
- Other versions: Unknown.
Fixed in
Unknown. No vendor advisory or fixed version found.
Workaround
- No vendor-published workaround found.
- Do not expose the application to the internet; restrict access to internal networks or a VPN.
Exploitation
- Known exploitation: No evidence found; not listed in CISA KEV.
- Public proof of concept: None found. The researcher has not published code.
- EPSS: 0.00363 (very low).
Our recommendation
- Ask ProPhoenix in writing for the fixed version and advisory for your build.
- Isolate any Law RMS instance from the internet immediately.
- Review access logs for logins or sessions that do not match the user who actually signed in.
- Verify the impact against the vendor's statement, as the CVE record describes only access to sensitive information.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ProPhoenix Law RMS product page prophoenix.com
- Sedric Louissaint: CVE-2024-34323 technical write-up sedriclouissaint.com
- Strix: CVE-2024-34323 www.strix.ai
- CVE Brief archive, 2026-10-14 cvebrief.com
- Vulners CNNVD-2026-21841663 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:26.
Original description (NVD)
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.