Medical Management System Insecure Permissions Vulnerability Allowing Arbitrary Password Resets

A vulnerability exists in the Medical Management System version a81df1ce700a9662cb136b27af47f4cbde64156b, allowing unauthorized users to reset passwords for specific accounts. This issue arises from inadequate permission controls on the password reset functionality, which can be exploited by directly targeting usernames.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, potentially leading to unauthorized access to user accounts.

Reproduction

The vulnerability can be reproduced by sending a request to the password reset endpoint for a specific user, such as 'admin' or 'yuangong1'. The request will bypass authentication checks and reset the user's password to '123456'.