CVE-2026-54106 - U.S. GAO EPDS and CBCA EDS network access control bypass
Summary
This entry details a vulnerability found in the target system. The exploit was published on 2026-06-18 and has garnered 94 views from the community. It is classified under the web apps category. Users are advised to review the source code in the Detail tab for technical specifics.
Zafiyet Özet Bilgileri
Zafiyet Detayı (Türkçe)
ABD Hükümeti Sorumluluk Ofisi (GAO) Elektronik Protesto Yerleştirme Sistemi (EPDS) ve Sivil Sözleşme İtiraz Kurulu (CBCA) Elektronik Yerleştirme Sistemi (EDS), X-Forwarded-For HTTP başlıklarını doğrulamaz ve bu durum, güvenliği ihlal edilmiş yönetici kimlik bilgilerine sahip uzak bir saldırganın ağ erişim kontrollerini atlayıp oturum açmasına olanak tanır.
Orijinal Açıklama (İngilizce)
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) do not validate X-Forwarded-For HTTP headers, allowing a remote attacker with compromised administrator credentials to bypass network access controls and log in.
Download Source
Download the exploit source code for offline analysis and testing.
Download NowFile Size: ~3.1 KB | MD5: d82f28af13ab397734bc5678e41411f6
No gallery images available.
No discussion yet.