| عنوان | SourceCodester Drug Recommendation System 1.0 Authentication Bypass Issues |
|---|
| الوصف | An improper access control vulnerability exists in SourceCodester Drug Recommendation System 1.0. Every administrative page in Admin/ uses header("Location: ../Auth/user_login") for authentication checks without calling exit() afterward. PHP header() sends an HTTP redirect but does not terminate script execution, so the full response body is still rendered. An attacker using curl or any client that ignores redirects can read all admin pages without authentication. There is also no role-based authorization check; any logged-in user (Doctor, Pharmacist) can access all administrative functions including user management, password changes, and deletions.
Vulnerable pattern repeated in every Admin/*.php:
if (empty($_SESSION['user_id'])) {
header("Location: ../Auth/user_login");
}
// NO exit() or die(); code continues to execute
Affected files: Admin/index.php, Admin/add_drug.php, Admin/add_symptom.php, Admin/add_user.php, Admin/change_password.php, Admin/delete_patient.php, Admin/delete_user.php, Admin/delete_symptom.php, Admin/delete_recommendation.php, Admin/delete_student.php, Admin/edit_user.php, Admin/edit_symptom.php, Admin/edit_class.php, Admin/enable_disable_user.php, Admin/predict.php, Admin/profile.php, Admin/recommend.php, Admin/user_record.php, Admin/patient_record.php, Admin/recommendation_record.php, Admin/symptom_record.php.
Proof of Concept (unauthenticated):
curl.exe -s http://TARGET/Admin/index.php | findstr "Welcome"
curl.exe -s http://TARGET/Admin/user_record.php | findstr "email"
curl.exe -s "http://TARGET/Admin/edit_user.php?id=1' UNION SELECT 1,2,name,4,password,role,7,8,9 FROM users-- -"
Impact: Unauthenticated access to all administrative pages, user data, patient records, and SQL injection endpoints. Any logged-in non-admin user can perform admin operations. CWE-862, CVSS v3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
|
|---|
| المصدر | ⚠️ https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html |
|---|
| المستخدم | swj99557271 (UID 101148) |
|---|
| ارسال | 10/09/2026 05:56 AM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 07:11 PM (1 month later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 413697 [SourceCodester Drug Recommendation System 1.0 Auth Guard user_id توثيق ضعيف] |
|---|
| النقاط | 0 |
|---|