Pharmacare
Monthly
Authorization bypass in Bdtask Pharmacy Management System up to version 9.4 allows authenticated remote attackers to manipulate user profile data via the /user/edit_user/ endpoint, escalating privileges or modifying other users' accounts without proper access controls. The vulnerability has publicly available exploit code and affects the User Profile Handler component, though vendor response to disclosure has been absent.
Authorization bypass in Bdtask Pharmacy Management System up to version 9.4 allows authenticated remote attackers to manipulate user profile data via the /user/edit_user/ endpoint, escalating privileges or modifying other users' accounts without proper access controls. The vulnerability has publicly available exploit code and affects the User Profile Handler component, though vendor response to disclosure has been absent.