{"id":26766,"date":"2025-04-19T01:11:46","date_gmt":"2025-04-19T01:11:46","guid":{"rendered":""},"modified":"2025-05-31T12:10:59","modified_gmt":"2025-05-31T18:10:59","slug":"cve-2025-32367-personal-identifiable-information-retrieval-in-oz-forensics-face-recognition-application","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-32367-personal-identifiable-information-retrieval-in-oz-forensics-face-recognition-application\/","title":{"rendered":"CVE-2025-32367: Personal Identifiable Information Retrieval in Oz Forensics Face Recognition Application<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability discussed in this post, labeled as CVE-2025-32367, affects the Oz Forensics face recognition application version prior to 4.0.8. This particular vulnerability can lead to unauthorized retrieval of personally identifiable information (PII). Any organization that uses this face recognition application in its security infrastructure should be aware of this vulnerability, as it could potentially lead to serious data leakage and system<\/a> compromise. This issue is of great concern due to the possible violations of privacy regulations and the potential financial and reputational damage that could result<\/a> from such violations.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-32367
\nSeverity: High (8.6)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: None
\nImpact: Unauthorized retrieval<\/a> of PII leading to possible system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Oz Forensics face recognition application | Versions prior<\/a> to 4.0.8<\/p>\n

How the Exploit Works<\/strong><\/p>\n

This vulnerability exploits an Insecure Direct Object<\/a> Reference (IDOR) within the \/statistic\/list endpoint. An attacker can manipulate parameters that reference objects directly in order to gain unauthorized access to data<\/a>. In this case, an attacker can potentially manipulate the IDOR to retrieve PII from the application<\/a> without the necessary permissions. The application fails to properly verify the user’s authorization before granting access to the requested data<\/a>, thus enabling the exploit.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s a conceptual example of how the vulnerability might be exploited in an HTTP request<\/a>:<\/p>\n

GET \/statistic\/list?id=1234 HTTP\/1.1\nHost: vulnerable.example.com<\/code><\/pre>\n
In this example, an attacker could manipulate the ‘id’ parameter to access data<\/a> of other users. For instance, changing ‘id=1234’ to ‘id=5678’ might allow access to another user’s personal data<\/a>.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
Users are advised to immediately update the Oz Forensics face recognition<\/a> application to the latest version. Although the version number remains the same (4.0.8), the vendor has released a patch to mitigate this vulnerability<\/a>. In cases where immediate patching is not possible, deploying a web application firewall (WAF) or intrusion detection system (IDS) to detect and block attempts to exploit this vulnerability<\/a> can serve as a temporary mitigation measure.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The vulnerability discussed in this post, labeled as CVE-2025-32367, affects the Oz Forensics face recognition application version prior to 4.0.8. This particular vulnerability can lead to unauthorized retrieval of personally identifiable information (PII). Any organization that uses this face recognition application in its security infrastructure should be aware of this vulnerability, as it could […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-26766","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t