External risk intelligence

ProPhoenix Law RMS IDOR Vulnerability Allows Sensitive Information Disclosure.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2024-34323

The vulnerable product is a Records Management System (RMS) designed for law enforcement agencies. Such platforms are frequently deployed as web-based applications accessible to authorized users over networks, including potentially the internet or wide-area agency networks, to facilitate remote access and information sharing, making them common targets for web-facing service exposure.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a law enforcement records management system, allowing unauthorized access to sensitive information through specially crafted web requests. This issue could potentially expose confidential data if the affected system is exposed to the internet or wide-area networks.

Attackers access sensitive law system data.
System manages law enforcement records and sensitive data.
Confirm if our law enforcement systems are affected.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted HTTP request to the ProPhoenix Law RMS. This request would leverage an Insecure Direct Object Reference (IDOR) flaw in the `usrLogin$hdnPFID` parameter, allowing the attacker to bypass authentication and access sensitive information. The vulnerability is reachable over the network without requiring any prior access or user interaction.

No authentication required.
Triggered by manipulated HTTP request parameter.
Allows unauthorized access to sensitive data.

Live Threat

Current exploitation, exposure, and threat context

The Insecure Direct Object Reference vulnerability in ProPhoenix Law RMS could allow an unauthenticated attacker to access sensitive information by sending a specially crafted HTTP request. This could expose confidential details within the records management system.

Sensitive information in the records system.
Via a crafted HTTP request.
Unrestricted access to confidential data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified Insecure Direct Object Reference vulnerability in ProPhoenix Law RMS likely impacts application owners and platform teams responsible for the system's security and availability. The immediate first step is to inventory all instances of ProPhoenix Law RMS, determine their network exposure, confirm business criticality, and identify the accountable owner for remediation planning.

Identify application and platform owners.
Verify system exposure and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ProPhoenix Law RMS?

ProPhoenix Law RMS is a records management system purpose-built for law enforcement agencies. It serves as a centralized platform to store, manage, and retrieve sensitive investigative, administrative, and case-related data. Organizations use this software to digitize and organize critical information necessary for daily public safety operations.

What does IDOR mean for CVE-2024-34323?

This CVE involves an Insecure Direct Object Reference, or CWE-639. It is a flaw where the software relies on user-provided input to identify internal objects, such as database records, without verifying if the user has permission to view them. By manipulating a specific parameter, an attacker can trick the system into serving data they are not authorized to access.

How is this vulnerability triggered?

The flaw is triggered by sending a specially crafted HTTP request that includes a manipulated value in the usrLogin$hdnPFID parameter. Because this vulnerability exists at the application level, simple actions like standard login attempts or navigating the user interface normally do not trigger the bug; it requires deliberate, unauthorized modification of these specific request parameters.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal identifies this as an external-facing risk because the vulnerable application is typically a web-based portal. Since these systems are often connected to wide-area networks or the internet to allow for remote access and inter-agency information sharing, the risk of unauthorized network access is significantly higher than for isolated, internal-only software.

What should I do if I run ProPhoenix Law RMS?

First, conduct an inventory to locate all instances of the software within your environment. Verify whether these instances are accessible over the internet or broad agency networks. Once identified, document the business criticality of each instance and coordinate with your vendor for guidance on remediation, such as security updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.