PT-2023-30028 · Sourcecodester · Sourcecodester Inventory Management System

Cyberlord · Published 2023-10-26 · Updated 2023-10-30 · CVE-2023-46449

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Free and Open Source inventory management system version 1.0

Description The issue allows an arbitrary user to change the password of another user and take over the account via Insecure Direct Object Reference (IDOR) in the password change function. This is due to incorrect access control, enabling unauthorized access to user accounts.

Recommendations For version 1.0, as a temporary workaround, consider disabling the password change function until a patch is available. Restrict access to the password change functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-46449

Affected Products

Sourcecodester Inventory Management System

References · 9

• 🔥 https://youtube.com/watch?v=H5QnsOKjs3s · Exploit
• 🔥 https://github.com/sajaljat/CVE-2023-46449/tree/main · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-46449 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46449 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1717525313507197290 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1717525060129259889 · Twitter Post
• https://t.me/cvenotify/60203 · Telegram Post
• https://twitter.com/CVEnew/status/1717560637071483268 · Twitter Post
• https://t.me/cibsecurity/72967 · Telegram Post