PT-2023-30028 · Sourcecodester · Sourcecodester Inventory Management System

Cyberlord · Publicado 2023-10-26 · Atualizado 2023-10-30 · CVE-2023-46449

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Free and Open Source inventory management system version 1.0

Description The issue allows an arbitrary user to change the password of another user and take over the account via Insecure Direct Object Reference (IDOR) in the password change function. This is due to incorrect access control, enabling unauthorized access to user accounts.

Recommendations For version 1.0, as a temporary workaround, consider disabling the password change function until a patch is available. Restrict access to the password change functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2023-46449

Produtos afetados

Sourcecodester Inventory Management System

Referências · 9

• 🔥 https://youtube.com/watch?v=H5QnsOKjs3s · Exploit
• 🔥 https://github.com/sajaljat/CVE-2023-46449/tree/main · Exploit
• https://twitter.com/VulmonFeeds/status/1717525313507197290 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-46449 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1717525060129259889 · Publicação no Twitter
• https://t.me/cvenotify/60203 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1717560637071483268 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-46449 · Aviso do Fabricante
• https://t.me/cibsecurity/72967 · Publicação no Telegram