CVE-2023-48392

CVE-2023-48392 is a critical vulnerability in Kaifa Technology WebITR, an online attendance system, stemming from the use of a hard-coded encryption key. This flaw allows an unauthenticated remote attacker to forge valid tokens, enabling unauthorized access to any user account, including administrator accounts, to execute their permissions and extract sensitive information. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.