Observable Response Discrepancy in amirsanni/mini-inventory-and-sales-management-system
Sep 26th 2021
It is possible to enumerate registered emails using forgot password functionality as application is showing the different response when email exists and does not exists
Proof of Concept
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.