Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)
Source Exploit-DB RSS Feed
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 11 Jun 2025, 21:12 UTC
What to do
AI-suggested
European organizations should prioritize upgrading Snipe-IT installations to version 8.1.0 or later, where the access control flaw has been fixed. Until upgrades can be performed, organizations should implement strict network segmentation and access controls to limit authenticated user access to only necessary locations. Monitoring and logging access to the `/locations/<id>/printassigned` endpoint should be enhanced to detect unusual access patterns or attempts to access unauthorized location IDs. Additionally, organizations can implement web application firewall (WAF) rules to detect and block suspicious URL parameter tampering targeting the `location_id` parameter. Conducting internal audits of user permissions and enforcing the principle of least privilege will reduce the risk of exploitation. Finally, organizations should review their asset management policies and train users to recognize and report suspicious behavior related to asset data access.
Description
Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)
Indicators of compromise
Exploit source code
# Exploit Title: Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)
# Google Dork: N/A
# Date: 2025-05-02
# Exploit Author: Sn1p3r-H4ck3r (Siripong Jintung)
# Vendor Homepage: https://snipeitapp.com
# Software Link: https://github.com/grokability/snipe-it
# Version: <= 8.0.4
# Tested on: Ubuntu 22.04 LTS, Apache2 + MySQL + PHP 8.1
# CVE: CVE-2025-47226
# Vulnerability Description:
Snipe-IT <= 8.0.4 contains an Insecure Direct Object Reference (IDOR) vulnerability in the
`/loca…