SourceCodester Inventory Management System CVE-2026-90697

Exploitation requires a valid authenticated session on the target application (PR:L - at minimum a low-privilege registered account). The vulnerability is specific to the invoice.php endpoint of SourceCodester Inventory Management System version 1.0 and requires the application to be network-reachable. No special configuration, non-default feature, or elevated privilege is required beyond a basic user account. Limiting factors: (1) the attacker must possess or obtain valid credentials for the target instance; (2) the application must be internet-facing or otherwise reachable by the attacker; (3) impact is limited to confidentiality of invoice data - no write, delete, or code execution is described.

Real-world risk is moderate and significantly lower than many IDOR findings because the CVSS 4.0 score of 5.3 (and an equivalent CVSS 3.1 of ~4.3) correctly reflects limited confidentiality impact with no integrity or availability component. The attack vector is network-accessible (AV:N), complexity is low (AC:L), but exploitation requires an authenticated low-privilege session (PR:L) - the attacker must hold a valid account on the target application. A public POC is available on GitHub (gist.github.com/fhewm98), which lowers the skill bar, but no CISA KEV listing or EPSS data was provided, suggesting no observed mass exploitation. The primary real-world risk is data exposure of other users' invoice records to competitor accounts or malicious insiders. SourceCodester products are frequently deployed in academic, student-project, or small-business contexts with limited security monitoring, which slightly elevates practical risk relative to the low base score.

An attacker creates or obtains a low-privilege account on a target Inventory Management System 1.0 deployment. After authenticating, the attacker iterates integer values of the ID parameter in requests to invoice.php (e.g., invoice.php?id=1, id=2, ...) to enumerate and retrieve invoice records belonging to other customers or business entities. A public GitHub proof-of-concept demonstrates this enumeration technique, requiring no additional tooling beyond a browser or curl.