Read the docs
TI-2024-32044 Aliases CVE-2024-47769

IDURAR has a Path Traversal (unauthenticated user can read sensitive data)

Priority HIGH 66CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement without additional checks. This allows an attacker to send URL encoded malicious payload. The directory structure can be escaped to read system files by adding an encoded string (payload) at subpath location.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00767 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
iduraridurar-erp-crmup to 4.1.0—No fix listedCNA
  • idurar-erp-crm Vendoridurar Affected up to 4.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:idurarapp:idurar:*:*:*:*:*:*:*:*up to 4.1.0VulnerableIdurarapp
  • cpe:2.3:a:idurarapp:idurar:*:*:*:*:*:*:*:* Versions up to 4.1.0 Vulnerable ·Idurarapp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47769

References

Exploit 1

Patch 1

  • TI-2026-56041 IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update CVSS 4.0HIGH 8.6
  • TI-2026-67386 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload CVSS 4.0MEDIUM 5.1
  • TI-2026-50857 Idurar IDURAR ERP CRM - Broken Access Control CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences