ProPhoenix Law RMS v2022.2403.3.101 contains an Insecure Direct Object Reference in the usrLogin$hdnPFID request parameter. The flaw allows an attacker to change the parameter value to reference data belonging to other users or system objects, resulting in the disclosure of sensitive information. The vulnerability is a classic IDOR issue, where the application trusts a client‑supplied identifier without validating ownership or authority.

The only explicitly documented affected product is ProPhoenix Law RMS version 2022.2403.3.101. No other versions or products were listed in the advisory.

Because the vulnerability can be triggered by crafting an HTTP request with a modified usrLogin$hdnPFID value, it is exploitable by anyone who can reach the application, regardless of authentication state. The EPSS score is < 1% and KEV indicates that the vulnerability is not listed. The CVSS score of 10 indicates maximum severity. The lack of official patch information means the risk remains until the vendor issues a fix or administrators implement compensating controls. The most likely attack vector is a remote request directed at the protected endpoint, leading to data exposure.