jshERP Access Control Vulnerability in Role Management Allowing Unauthorized Supplier Status Modification

An access control vulnerability has been identified in jshERP version 3.5, specifically within the RoleController component. This flaw allows unauthorized attackers to arbitrarily change the supplier status for any account. The issue arises from improper access control, enabling unauthorized modifications through the role management interface.

Impact

Exploitation of this vulnerability allows unauthorized users to access and modify role information and supplier statuses across all accounts.

Reproduction

To reproduce this vulnerability, log into a jshERP account and navigate to the role management section. Once there, intercept the request using a tool like Burp Suite. Remove the authorization token from the request and change the request path to access the role management data for all accounts. This will bypass the authorization checks and allow unauthorized modifications.