Soumettre #833945: Kushan2k student-management-system 1.0 Unauthenticated Admin Profile Update Endpoint

The `edit-admin` action in `AdminController.php` allows an administrator to update their email or password. However, the endpoint **does not verify whether the current user is logged in as an administrator** – there is no check for `$_SESSION['isadmin']` or similar. Any unauthenticated visitor can trigger the update logic by simply sending a POST request.

Furthermore, the underlying database operations in `config/User.php` build SQL queries by directly concatenating user‑supplied parameters:

```php
// getAdmin()
$res = $this->db->query("SELECT * FROM admin WHERE id={$id}");

// updateAdminEmail()
$res = $this->db->query("UPDATE admin SET email='{$email}' WHERE id={$id}");

// updateAdminPassword()
$res = $this->db->query("UPDATE admin SET password='{$newpass}' WHERE id={$id}");
```

These queries are vulnerable to SQL injection if the id or email parameters are manipulated. Combined with the missing authentication, an attacker can:

Modify any administrator’s email (leading to account takeover via password reset)

Change an admin’s password (locking them out)

Potentially exploit the SQL injection to read or modify other data

• La source: ⚠️ https://github.com/Kushan2k/student-management-system/issues/3
• Utilisateur: Pr0x1ma (UID 98396)
• Soumission: 20/05/2026 08:42 (il y a 21 jours)
• Modérer: 07/06/2026 11:38 (18 days later)
• Statut: Accepté
• Entrée VulDB: 369096 [Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin isadmin élévation de privilèges]
• Points: 20