This vulnerability in Rizwan17 inventory-management-system up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f allows remote attackers to bypass authentication by manipulating the order_date or invoice_no arguments in the includes/invoice_bill.php file related to invoice generation. The issue leads to missing authentication checks, enabling unauthorized access or actions. The product's rolling release model means no explicit versioning is available for affected or patched states. The vulnerability has been publicly disclosed with exploit code available, but no vendor response or patch has been issued as of the publication date.

An attacker can remotely exploit this vulnerability to bypass authentication controls in the invoice generation component, potentially allowing unauthorized access or manipulation of invoice data. This could lead to unauthorized viewing or modification of sensitive billing information. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges required, no user interaction, and low impact on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for updates from the Rizwan17 project. Until a patch is available, consider restricting access to the affected component or implementing additional authentication controls as a temporary mitigation.