Unauthenticated LDAP Account Manager

What is the "Unauthenticated LDAP Account Manager?"

The "Unauthenticated LDAP Account Manager" module is designed to detect misconfigurations in LDAP Account Manager software. It targets instances of the software that are accessible without authentication. This module has a medium severity level and was authored by tess.

Impact

If a misconfigured instance of LDAP Account Manager is detected, it could potentially expose sensitive information or allow unauthorized access to user profiles. This could lead to unauthorized modifications or unauthorized access to user data.

How the module works?

The "Unauthenticated LDAP Account Manager" module works by sending an HTTP GET request to the "/templates/config/profmanage.php" path. It then applies a series of matching conditions to determine if the target is vulnerable. The matching conditions include checking for specific words in the response body, such as "LDAP Account Manager," "Profile management," and "Add profile." Additionally, it checks for the presence of the "text/html" header and a 200 status code.

By analyzing the response, the module can identify instances of LDAP Account Manager that are accessible without authentication and potentially vulnerable to misconfiguration.