Carlos Aguadé

**Name of the Vulnerable Software and Affected Versions** TCMAN GIM version 11 **Description** A missing authentication vulnerability in TCMAN GIM version 11 allows an unauthenticated attacker to access resources such as /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser, and /frmGestionUser.aspx/DeleteUser. This enables the attacker to access and modify user data. **Recommendations** For TCMAN GIM version 11, as a temporary workaround, consider disabling access to the `/frmGestionUser.aspx/GetData`, `/frmGestionUser.aspx/updateUser`, and `/frmGestionUser.aspx/DeleteUser` endpoints until a patch is available. Restrict access to the user management functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TCMAN's GIM version 11 **Description** The issue concerns time-based blind SQL injection vulnerabilities. These vulnerabilities allow an attacker to retrieve, create, update, and delete databases through the `ArbolID` parameter in the "/GIMWeb/PC/frmCorrectivosList.aspx" API endpoint. **Recommendations** For TCMAN's GIM version 11, consider disabling the `ArbolID` parameter in the "/GIMWeb/PC/frmCorrectivosList.aspx" API endpoint as a temporary workaround until a patch is available. Restrict access to the vulnerable API endpoint to minimize the risk of exploitation. Avoid using the `ArbolID` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TCMAN's GIM version 11 **Description** Time-based blind SQL injection vulnerabilities in TCMAN's GIM allow an attacker to retrieve, create, update, and delete databases through the `ArbolID` parameter in "/GIMWeb/PC/frmPreventivosList.aspx". **Recommendations** For TCMAN's GIM version 11, consider disabling the `ArbolID` parameter in the "/GIMWeb/PC/frmPreventivosList.aspx" endpoint as a temporary workaround until a patch is available. Restrict access to the "/GIMWeb/PC/frmPreventivosList.aspx" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TCMAN's GIM version 11 **Description** A missing authorization vulnerability in TCMAN's GIM allows an authenticated attacker to access any functionality of the application, even when they are not available through the user interface. To exploit the vulnerability, the attacker must modify the HTTP code of the response from ‘302 Found’ to ‘200 OK’, as well as the hidden fields `hdnReadOnly` and `hdnUserLogin`. **Recommendations** For TCMAN's GIM version 11, consider implementing proper authorization checks to restrict access to unauthorized functionalities. As a temporary workaround, consider monitoring and restricting modifications to the HTTP response code and the hidden fields `hdnReadOnly` and `hdnUserLogin` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.