Summary

SourceCodester Inventory Management System 1.0 has an improper access control flaw in the Password Handler (edit_update.php). The handler selects the target account from the client supplied user_id parameter rather than the authenticated session, so a logged in user can act on another user’s account.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N — 4.3 Medium (VulDB).

Note: NVD/NIST resorced this 9.8 Critical, but the originating CNA (VulDB) scored it 4.3 Medium.

Details

edit_update.php derives the account to update from the request-supplied user_id instead of the server-side session identity, and does not verify that the authenticated user is authorized to modify that account. By substituting a different user_id, an authenticated user can apply changes to an account that isn’t theirs.

Impact

Account takeover via unauthorized password/profile changes. Combined with an admin user_id, this can yield privilege escalation.

Remediation

  • Derive the target account from the authenticated session, never from a client-controlled parameter.
  • Enforce an authorization check that the acting user may modify the target record.

This affects the end-of-life 1.0 release; no vendor patch is available.

Disclosure Timeline

  • 2023-08-06 — Publicly disclosed (VDB-236218 / CVE-2023-4183).

References