PT-2021-20892
CVE-2021-35337
·
تاريخ النشر
2021-07-01
·
تاريخ التحديث
2022-05-03
الوصف من
CVSS 3.1
4.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions:
Sourcecodester Phone Shop Sales Management System version 1.0
Description:
The issue allows an attacker to view invoices of different users by modifying the
id parameter, indicating a lack of proper access control. This could potentially expose sensitive information.Recommendations:
For Sourcecodester Phone Shop Sales Management System version 1.0, restrict access to the invoice viewing functionality to prevent unauthorized users from modifying the
id parameter and accessing other users' invoices. Consider implementing proper authentication and authorization mechanisms to ensure that only authorized users can view invoices. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾