Unauthenticated Category Addition in Rizwan17 inventory-management-system

A security vulnerability exists in the Rizwan17 inventory-management-system (commits up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f). The flaw is located within the DBOperation.addCategory function in the includes/process.php file, which handles AJAX backend requests. An attacker can manipulate the userid argument to bypass authentication checks, allowing for unauthorized modifications to the inventory categories. Because the project utilizes a rolling release model, no specific version numbers are assigned to the affected or patched code. Publicly available exploit code currently exists for this vulnerability, increasing the risk of active exploitation by remote threat actors. The project maintainers have been notified of the issue but have not yet provided a fix or response.

Impact

Successful exploitation allows unauthenticated remote attackers to add unauthorized categories to the inventory system. This can be used to manipulate business logic, disrupt inventory tracking, or serve as a vector for further unauthorized database interactions within the application.

Recommendation

• Monitor web server access logs for anomalous POST requests directed at /includes/process.php.
• Audit the application source code for the DBOperation.addCategory function and implement robust session validation checks for the userid parameter.
• Given the lack of a vendor-provided patch, consider placing the inventory-management-system behind a Web Application Firewall (WAF) or restricting access to the includes/ directory via IP-based access control lists (ACLs).