A critical access control vulnerability in jshERP v3.5 exposes sensitive system data to unauthenticated attackers, posing a significant risk of unauthorized information disclosure.

The vulnerability resides in the ResourceController.java component, where insufficient access control logic allows unauthenticated users to access arbitrary account data by modifying ID values.

The ability for an unauthenticated attacker to harvest sensitive ID data and potentially gain unauthorized account access presents a severe risk to organizational confidentiality and integrity. Given the CVSS score of 8.8, this vulnerability is classified as High severity, as it facilitates unauthorized access to potentially administrative or user-level information, which could lead to further system compromise or data exfiltration.

Immediate Action: Since a direct vendor patch status is currently unknown, administrators should restrict network access to the jshERP instance and disable the affected ResourceController component if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous requests to the ResourceController endpoint, specifically looking for sequential or brute-force attempts at ID enumeration.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests that attempt to modify or enumerate ID parameters within the application traffic.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research reference.

Given the High severity of this vulnerability and the availability of a public proof-of-concept, immediate defensive action is required. Organizations using jshERP v3.5 must prioritize restricting exposure of the application to the internet and should actively seek updates from the vendor to remediate the underlying access control deficiency.