CVE-2023-46449

Name of the Vulnerable Software and Affected Versions Sourcecodester Free and Open Source inventory management system version 1.0

Description The issue allows an arbitrary user to change the password of another user and take over the account via Insecure Direct Object Reference (IDOR) in the password change function. This is due to incorrect access control, enabling unauthorized access to user accounts.

Recommendations For version 1.0, as a temporary workaround, consider disabling the password change function until a patch is available. Restrict access to the password change functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.