An authorization bypass vulnerability in jshERP versions 3.6 and earlier allows authenticated attackers to perform account takeovers of any user, including administrators.

The application fails to perform adequate authorization checks on the POST /user/resetPwd endpoint. By submitting a request with an arbitrary target user ID, any authenticated user can reset the password of another account to a known value, leading to full account takeover.

The ability for a low-privilege user to reset administrator passwords constitutes a critical security failure, effectively granting an attacker full control over the ERP system. This risk is reflected in the high CVSS score of 8.8, which highlights the potential for complete compromise of confidentiality, integrity, and availability. Unauthorized access to enterprise resource planning data can lead to significant financial, operational, and reputational damage.

Immediate Action: Upgrade to a version of jshERP beyond 3.6 that includes the security patch. If a patch is not immediately available, restrict network access to the application to prevent unauthorized parties from reaching the management endpoints.

Proactive Monitoring: Review web server and application access logs for anomalous POST requests directed at the /user/resetPwd endpoint, particularly those originating from non-administrator user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block or inspect unauthorized requests to sensitive administrative endpoints, specifically targeting password reset functions.

Public Exploit Available: Yes, a proof of concept script is publicly available via a GitHub repository linked in the security researcher's write-up.

Given the severity of this account takeover flaw, immediate action is required. Organizations using jshERP should verify their version and prioritize the application of vendor-supplied patches. Until remediation is confirmed, consider the application at high risk of compromise and implement strict access controls for all authenticated users.