Sushmi-pal Invoice-System Profile Workflow profile improper authorization

Vulnerability

The vulnerability is an Insecure Direct Object Reference (IDOR) in the profile workflow of Sushmi-pal Invoice-System up to commit a0a3faa16dee2621b231ae227333f5761607283b. The /profile/{id} endpoint (GET and POST) accepts a user-controlled id parameter but fails to verify that the requested profile belongs to the authenticated user. This affects the Invoice System in Laravel version 1.0 [1]. The product uses rolling releases, so no specific version numbers are available for affected or fixed releases.

Exploitation

An attacker can exploit this vulnerability remotely after authenticating as any user. By simply changing the id in the URL (e.g., /profile/1 to /profile/2), the attacker can view or modify another user's profile data without authorization. The PoC demonstrates a POST request that updates the target profile's name and email [1]. No additional privileges or user interaction beyond a valid session are required.

Impact

Successful exploitation allows an attacker to access private profile information (confidentiality) and arbitrarily modify any user's name, email, and settings (integrity). This could lead to account takeover if the email is changed, enabling password reset bypass [1].

Mitigation

No official fix has been released; the vendor did not respond to the disclosure [1]. Recommended mitigations include binding profile actions to the authenticated user via auth()->user() instead of accepting an ID from the route, implementing authorization policies, and using non-sequential UUIDs to prevent enumeration [1]. As of the publication date, the vulnerability remains unpatched.