| Titre | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d Exposure of Private Personal Information to an Unauthorized Acto |
|---|
| Description | The affected component is `delivery/checkfarmer.json.php`, the AJAX endpoint used by the delivery form to look up a farmer. Unlike every other page, it only includes the database connection file and **does not include `incl/header.incl.php`**, which is where the session/authentication check lives. The endpoint takes `$_POST['fname']` (a farmer number) and returns the matching farmer's personal data:
```php
include_once '../incl/conn.incl.php';
$fname=$_POST['fname'];
$fqry= mysqli_query($conn,"select * from farmers where f_no='". mysqli_real_escape_string($conn, $fname) ."'") ...
?>
<span class='input-xlarge uneditable-input' ><?php echo $farmer['f_name']; ?></span>
...
<span class="input-xlarge uneditable-input" ...><?php echo $farmer['f_locallity']; ?></span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_ac']; ?> </span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_phone'] ?> </span>
```
An unauthenticated attacker can enumerate farmer numbers (`f_no` values are sequential) and harvest the full name, locality, **bank account number** (`f_ac`), and **phone number** (`f_phone`) of every registered farmer without logging in. This discloses sensitive personal and financial information of third parties. |
|---|
| La source | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/5 |
|---|
| Utilisateur | Elymas (UID 98074) |
|---|
| Soumission | 02/10/2026 14:33 (il y a 17 jours) |
|---|
| Modérer | 18/10/2026 18:26 (16 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 421856 [Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php fname divulgation d'information] |
|---|
| Points | 20 |
|---|