| शीर्षक | SourceCodester Human Resource Management System 10 No Auth Check on the Employee Endpoint: Anyone Creates an Admin, |
|---|
| विवरण | controller/employee.php calls session_start() and nothing else — there is no isset($_SESSION['User']) check anywhere in the file (contrast header.php, which enforces it for page views). The endpoint works with zero cookies.
role and password come straight from $_POST (lines 29, 32); the INSERT persists RoleId='$role', so role=1 creates a real administrator row. PoC A: pre-auth admin creation, then normal login to the admin dashboard.
The UPDATE branch (?empedit=1, EmpId from $_GET) sets Password/RoleId WHERE EmpId='1' — direct takeover of the seed admin ([email protected] / admin#123). PoC B succeeded.
The same unguarded endpoint handles pfimg uploads; the only type check is the client-supplied $_FILES['pfimg']['type'] (spoofed via multipart Content-Type). The extension is preserved, so a .php shell lands web-accessible in hrm/image/. PoC C: GET returned HTTP 200 with the PHP output — RCE primitive. |
|---|
| स्रोत | ⚠️ https://tracexlabs.com/releases/hrm-10-preauth-admin-takeover.html |
|---|
| उपयोगकर्ता | SanthoshKumar (UID 101638) |
|---|
| सबमिशन | 25/09/2026 03:34 PM (17 दिन पहले) |
|---|
| संयम | 11/10/2026 09:57 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416791 [SourceCodester Human Resource Management System 1.0 Employee Endpoint controller/employee.php session_start role/pfimg/EmpId कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|