| Titel | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization |
|---|
| Beschreibung | The affected components are the admin display pages such as `Admin/showdoctor.php`, `Admin/showclinic.php`, `Admin/showmanager.php`, and `Admin/showdoctorschedule.php`. These pages query and print data without any session or role check:
```php
<?php
require_once("dbconfig.php");
$result = $conn->query("SELECT * FROM doctor");
// ... echo total count and all rows
?>
```
An unauthenticated attacker can directly request these URLs and read the complete doctor, clinic, and manager records. |
|---|
| Quelle | ⚠️ https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/14 |
|---|
| Benutzer | a86402175 (UID 101298) |
|---|
| Einreichung | 16.09.2026 15:53 (vor 1 Monat) |
|---|
| Moderieren | 12.10.2026 21:04 (26 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 417188 [girishsaraf Online-Appointment-Booking-System bis f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Admin Display Pages Admin/showdoctor.php erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|