An unauthenticated privilege escalation vulnerability exists in the Rizwan17 inventory-management-system that allows attackers to manipulate user account types during registration.

The flaw resides in the createUserAccount function within register.php, where insufficient validation of the usertype argument allows an unauthenticated attacker to assign unauthorized privilege levels.

The ability to manipulate account types during registration poses a significant risk of unauthorized privilege escalation. Successful exploitation could allow attackers to gain administrative access to the inventory management system, potentially leading to data exfiltration, unauthorized modification of inventory records, and full compromise of the application environment. With a CVSS score of 7.3, this high-severity issue necessitates immediate attention to prevent unauthorized administrative control.

Immediate Action: As no official patch is currently available, administrators should audit existing user accounts for suspicious administrative privileges and consider disabling public account registration until the vendor provides a fix.

Proactive Monitoring: Monitor server access logs for anomalous registration attempts and review the user database for accounts with elevated permissions that were created outside of established administrative workflows.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block registration requests that contain unauthorized values in the usertype parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue report referenced in the CVE record.

Given the high CVSS score and the presence of a public proof-of-concept, organizations using this software must treat this as a priority security concern. Since the vendor has not yet released a patch, proactive monitoring and the implementation of restrictive access controls are essential to mitigate the risk of unauthorized account creation and privilege escalation. Monitor the official repository for updates and apply them as soon as they become available.