| عنوان | onetwothreeneth HospitalManagementSystem 9ef91ed6007314b6473110ed699dff76d158f61d Missing Authorization |
|---|
| الوصف | Affected: `php/controller.php` handlers `update_subaccount` (lines 233-260), `archive_user` (221-225), `add_account` (203-219), and pages `accounts.php`, `new_account.php`, `edit_accounts.php` (the pages that reach them). These account-administration handlers are gated only by the ineffective client-side menu hiding in `bones/a_header.php` (lines 127 & 133: `display:none` for non-admins) and never perform any server-side role check. `update_subaccount` accepts an arbitrary `user_id` (filters only SQL-escapes it): `udi("$u users set name='$name',user='$user',pass='$pass' where user_id='$user_id'")`. Any session - even an anonymous request (the session guard does not exit, see the authentication finding) - can reset the password of the built-in admin (user_id=1) and sign in as admin, taking over the whole application. |
|---|
| المصدر | ⚠️ https://github.com/onetwothreeneth/HospitalManagementSystem/issues/7 |
|---|
| المستخدم | Cevz68 (UID 101220) |
|---|
| ارسال | 14/09/2026 04:52 PM (21 أيام منذ) |
|---|
| الاعتدال | 05/10/2026 12:15 PM (21 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 413576 [onetwothreeneth HospitalManagementSystem حتى 9ef91ed6007314b6473110ed699dff76d158f61d Account Administration php/controller.php update_subaccount user_id تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|