Description

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function createUserAccount of the file register.php of the component Registration Handler. Executing a manipulation of the argument usertype can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T16:16:52.670Z",
  "pubdate": "2026-09-13T16:16:52.670Z",
  "executiveSummary": "A critical improper authorization vulnerability exists in the Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.\nThe vulnerability resides within the createUserAccount function in register.php, allowing an attacker to manipulate the usertype argument during account creation.\nThis flaw enables unauthorized privilege escalation, where a remote attacker can register an account with elevated permissions, such as an administrator role, bypassing intended registration constraints.\nThe risk is severe as it grants unauthorized users full control over the system, potentially leading to total compromise of inventory data and administrative functionality.\nThe vulnerability is publicly disclosed, and exploitation does not require prior authentication, making it trivial for remote actors to target publicly accessible instances.\nThe project maintains a rolling release model, and no official vendor patches are currently available, leaving deployed systems in an exposed state.",
  "technicalDetails": "The vulnerability originates from a lack of server-side validation of the 'usertype' input parameter within the 'createUserAccount' function located in 'register.php'.\nIn the registration process, the application accepts user-supplied data to construct a new account record. The logic fails to sanitize or verify that the 'usertype' submitted by the client matches the expected, low-privileged default user role.\nInstead, the application implicitly trusts the client-provided input, mapping the user-supplied string directly to the database role column for the new account.\nAn attacker can exploit this by intercepting the registration HTTP request and modifying the 'usertype' parameter to include administrative or privileged role identifiers (e.g., 'admin' or 'superuser').\nBecause the 'createUserAccount' function does not enforce an allow-list or perform an authorization check to determine if the requester is permitted to assign specific user roles, the application creates a high-privileged account upon processing the malicious payload.\nThis is a remote, unauthenticated vulnerability. The attacker does not need an existing session or valid credentials to trigger the flaw, as the registration endpoint is typically exposed to public network traffic.\nThe attack flow follows a straightforward sequence: 1) The attacker initiates the registration flow as defined in 'register.php'. 2) The attacker captures the HTTP POST request. 3) The attacker injects or modifies the 'usertype' parameter with a privileged value. 4) The server-side logic processes the input and persists the user record with elevated privileges in the backend database. 5) The attacker authenticates using the newly created account, gaining unauthorized access to privileged functionality.\nThe post-exploitation impact includes full system compromise, unauthorized access to sensitive inventory datasets, and the potential to modify system configurations, delete records, or manipulate administrative settings, depending on the breadth of the injected user role."
}