| Título | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d Exposure of Private Personal Information to an Unauthorized Acto |
|---|
| Descripción | The affected component is `delivery/checkfarmer.json.php`, the AJAX endpoint used by the delivery form to look up a farmer. Unlike every other page, it only includes the database connection file and **does not include `incl/header.incl.php`**, which is where the session/authentication check lives. The endpoint takes `$_POST['fname']` (a farmer number) and returns the matching farmer's personal data:
```php
include_once '../incl/conn.incl.php';
$fname=$_POST['fname'];
$fqry= mysqli_query($conn,"select * from farmers where f_no='". mysqli_real_escape_string($conn, $fname) ."'") ...
?>
<span class='input-xlarge uneditable-input' ><?php echo $farmer['f_name']; ?></span>
...
<span class="input-xlarge uneditable-input" ...><?php echo $farmer['f_locallity']; ?></span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_ac']; ?> </span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_phone'] ?> </span>
```
An unauthenticated attacker can enumerate farmer numbers (`f_no` values are sequential) and harvest the full name, locality, **bank account number** (`f_ac`), and **phone number** (`f_phone`) of every registered farmer without logging in. This discloses sensitive personal and financial information of third parties. |
|---|
| Fuente | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/5 |
|---|
| Usuario | Elymas (UID 98074) |
|---|
| Sumisión | 2026-10-02 14:33 (hace 17 días) |
|---|
| Moderación | 2026-10-18 18:26 (16 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 421856 [Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php fname divulgación de información] |
|---|
| Puntos | 20 |
|---|