Threats tagged 'ghsa-c532-w5jh-m2g6'

REDAXO versions before 5.21.5 have a missing authorization vulnerability in the backup addon export feature. This flaw allows non-admin users with the backup[export] permission to export any database table, including sensitive tables such as rex_user and rex_user_session. Exploitation can lead to attackers obtaining plaintext session IDs and stay-logged-in keys to hijack admin accounts or password hashes for offline cracking.