Description

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-09T22:18:47.390Z",
  "pubdate": "2026-09-09T22:18:47.390Z",
  "executiveSummary": "A critical missing authentication vulnerability exists in the inventory-management-system repository developed by Rizwan17, specifically affecting the DBOperation.addCategory function within includes/process.php.\nThe vulnerability stems from improper validation of the userid argument during AJAX backend operations, allowing unauthenticated remote attackers to interact with sensitive administrative functions.\nThis flaw allows unauthorized users to manipulate system categories, potentially leading to unauthorized data modification or integrity loss.\nThe vulnerability is currently exposed to remote exploitation, and with public exploit code already available, the risk to affected deployments is high.\nThe project utilizes a rolling release model, meaning specific vulnerable version strings are not defined beyond the commit hash bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.\nSuccessful exploitation requires no authentication, granting remote attackers the ability to bypass intended access controls and execute logic meant solely for authorized administrators.",
  "technicalDetails": "The vulnerability resides in the AJAX backend component of the Rizwan17 inventory-management-system, specifically within the DBOperation.addCategory method located in includes/process.php.\nThe root cause is a failure to verify the authentication status or session integrity of the requester before processing inputs, specifically relying on user-supplied data in the userid argument without server-side validation against an active, privileged session.\nWhen a request is directed to the AJAX endpoint, the backend process fails to perform a formal check to ensure that the calling entity possesses the necessary credentials or session state to perform database operations.\nThe attack flow proceeds as follows: 1) The remote attacker crafts a malicious HTTP request targeting the AJAX backend endpoint. 2) The attacker includes an arbitrary or manipulated userid parameter within the request payload. 3) The includes/process.php script processes the request via the DBOperation.addCategory function, failing to validate whether the request originated from an authenticated administrator. 4) The application processes the input as a legitimate action, resulting in the unauthorized creation or modification of categories in the inventory database.\nBecause the function fails to enforce authorization checks at the entry point of the business logic, the application effectively treats the unauthenticated request as a trusted administrative command.\nThe post-exploitation impact includes the potential to corrupt the system's category structure, inject malicious data into the application, or disrupt standard inventory management workflows. Given that this component is designed for administrative use, the lack of session verification represents a complete breakdown of the authorization boundary.\nThe threat is exacerbated by the existence of public exploit code, which lowers the barrier to entry for attackers. Since the project uses a continuous delivery mechanism, all installations tracking the commit hash bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and prior are considered susceptible until a security patch is implemented that explicitly verifies user authentication headers or session tokens before executing the addCategory function."
}