| शीर्षक | SourceCodester Inventory-Management-System-PHP 1.0 Missing Authorization |
|---|
| विवरण | An Insecure Direct Object Reference (IDOR) vulnerability exists in Product Inventory Management System by SourceCodester. The invoice page at /invoice.php accepts a user-supplied id parameter via GET request and returns invoice data without verifying whether the authenticated user has permission to access the requested resource. An authenticated low-privileged staff user can enumerate and access all invoices belonging to other users by incrementing the id parameter, exposing sensitive customer information including names, contact details, product details, and financial transaction amounts. |
|---|
| स्रोत | ⚠️ https://gist.github.com/fhewm98/079112d415afa63ed1368a798a352665 |
|---|
| उपयोगकर्ता | Mohammed Faheem (UID 100387) |
|---|
| सबमिशन | 05/08/2026 01:32 PM (1 महीना पहले) |
|---|
| संयम | 13/09/2026 07:14 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403230 [SourceCodester Inventory Management System 1.0 invoice.php पहचान अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|