| Titel | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization |
|---|
| Beschreibung | The affected component is the root `changebookingstatus.php` `submit2` handler. It updates appointment statuses based solely on POST parameters without any session or role check:
```php
if(isset($_POST['submit2']))
{
$usrnm=$_POST["username"];
$stts=$_POST["status"];
...
$updatequery="update book set Status='$stts[$j]' where username='$usrnm[$j]' and timestamp='$tmstmp[$j]'";
mysqli_query($conn, $updatequery);
}
```
An unauthenticated attacker can submit arbitrary `username[]`, `timestamp[]`, and `status[]` arrays to overwrite any appointment's status.
|
|---|
| Quelle | ⚠️ https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/15 |
|---|
| Benutzer | huimouwaner (UID 101296) |
|---|
| Einreichung | 16.09.2026 15:54 (vor 1 Monat) |
|---|
| Moderieren | 12.10.2026 21:04 (26 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 417189 [girishsaraf Online-Appointment-Booking-System bis f427b4757128ca253d33d0cc4e87bbb9c999a4d5 submit2 changebookingstatus.php username[]/timestamp[]/status[] erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|