Incorrect Access Control in Sourcecodester Free Inventory Management System by Sourcecodester
CVE-2023-46449

8.8HIGH

Key Information:

Vendor

Mayurik

Status
Inventory Management System
Vendor
CVE Published:
26 October 2023

Badges

👾 Exploit Exists

What is CVE-2023-46449?

The Sourcecodester Free Inventory Management System version 1.0 is prone to an Incorrect Access Control vulnerability. This flaw allows an unauthorized user to exploit an Insecure Direct Object Reference (IDOR) in the password change functionality, enabling them to change another user's password without authentication. This can lead to account takeover, posing significant security risks to user data within the inventory management system.

References

https://github.com/sajaljat/CVE-2023-46449/tree/main
https://www.youtube.com/watch?v=H5QnsOKjs3s

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.