| शीर्षक | itsmeravitejak Online-Examination-System e6208e630b14657999bbfe4c9912302d2a1e2449 Missing Authentication |
|---|
| विवरण | The affected component is the `admin/` directory. The data endpoints `admin/qsdb.php`, `admin/usersdb.php`, `admin/brandb.php`, `admin/topicsdb.php` and `admin/subjectsdb.php` only include `../include/database.php` and perform no authentication or authorization check at all; `admin/admin.php` renders the full admin center for any visitor because it only includes `../include/session.php` without calling `$session->isAdmin()` (unlike `adminprocess.php`, `banuser.php` or `qsuploader.php`, which do check). Any unauthenticated visitor can therefore download the complete question bank **including the correct answer of every question** (`qsdb.php` exposes the `q_ans` column in its JSON grid), the full user directory with email addresses (`usersdb.php`), and the branches/subjects/topics data. This defeats the entire purpose of the examination system (answers are disclosed to examinees) and leaks personal data of all registered users. |
|---|
| स्रोत | ⚠️ https://github.com/itsmeravitejak/Online-Examination-System/issues/4 |
|---|
| उपयोगकर्ता | PrivacyFirst (UID 101731) |
|---|
| सबमिशन | 29/09/2026 01:16 PM (18 दिन पहले) |
|---|
| संयम | 17/10/2026 11:35 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421582 [itsmeravitejak Online-Examination-System तक e6208e630b14657999bbfe4c9912302d2a1e2449 admin/admin.php isAdmin कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|