| Titel | satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a Missing Authentication |
|---|
| Beschreibung | The affected components are all pages in the site root: `index.php`, `submit.php`, `edit.php`, `doedit.php`, `delete.php`, `dodelete.php`, `search.php`, `fetch.php`, `report.php`, `createpdf.php`. The application contains no login page, no session handling, and no authorization check whatsoever — administrative functions (viewing every registrant's personal data, editing any record, deleting any record) are exposed directly to the internet. Verified: every page returns HTTP 200 to an unauthenticated client, a request to `/login.php` returns 404 (no login mechanism exists), and anonymous POSTs to `submit.php`, `doedit.php`, and `dodelete.php` all execute their database operations.
|
|---|
| Quelle | ⚠️ https://github.com/satya-vinay/Events-Management-System/issues/4 |
|---|
| Benutzer | xbjds (UID 101126) |
|---|
| Einreichung | 04.10.2026 17:47 (vor 22 Tagen) |
|---|
| Moderieren | 19.10.2026 07:23 (15 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 422248 [satya-vinay Events-Management-System bis 437c77ceb69bf9fe2e3f4f46f7871b83f425383a schwache Authentisierung] |
|---|
| Punkte | 20 |
|---|